MalwarePublished 2 Jul 2025

DEVMAN Ransomware: Analysis of New DragonForce Variant

Source AlienVault OTX General

Description

A new ransomware strain resembling DragonForce but with unique traits has emerged, possibly connected to an entity called DEVMAN. The sample reuses DragonForce code but adds its own elements, including the .DEVMAN file extension. Attribution is unclear, as the ransom note is identical to DragonForce's. The malware operates offline, probes for SMB connections, and uses three encryption modes. It exhibits different behaviors on Windows 10 and 11, particularly in changing wallpapers. The ransomware encrypts its own ransom notes, likely due to a builder flaw. DEVMAN claims to have stopped using DragonForce months ago, suggesting this may be an experimental or outdated build.

Impact

For European organizations, the DEVMAN ransomware poses a significant threat to data confidentiality and availability. Its ability to encrypt files with multiple encryption modes and target SMB shares suggests potential for rapid lateral movement within corporate networks, especially in environments with poorly segmented networks or exposed SMB services. The encryption of ransom notes could complicate incident response and negotiation processes. The ransomware's differing behavior on Windows 10 and 11 means organizations running mixed environments may face inconsistent infection symptoms, complicating detection and remediation. Given the ransomware operates offline, it may not require command-and-control infrastructure, making it harder to disrupt once deployed. The medium severity rating indicates that while the ransomware is dangerous, it may have limitations such as the builder flaw affecting ransom note readability, possibly reducing its effectiveness. However, the reuse of DragonForce code and the association with known ransomware families like Conti and Blacklock (as indicated by tags) suggest a potential for evolution into more damaging variants. European organizations with extensive Windows infrastructure, especially those relying on SMB for file sharing, are at risk of data loss, operational disruption, and financial impact due to ransom demands or recovery costs.

Defensive guidance

1. Network Segmentation: Strictly segment networks to limit SMB exposure and lateral movement opportunities. 2. SMB Hardening: Disable SMBv1 and restrict SMB access to only trusted hosts. Implement SMB signing and enforce strong authentication. 3. Patch Management: Although no specific patches exist for this ransomware, ensure all Windows systems are fully patched to reduce attack surface and prevent exploitation of other vulnerabilities. 4. Endpoint Detection and Response (EDR): Deploy advanced EDR solutions capable of detecting ransomware behaviors such as unusual file encryption patterns, changes to desktop wallpaper, and suspicious SMB scanning activities. 5. Backup Strategy: Maintain offline, immutable backups with frequent testing to ensure rapid recovery without paying ransom. 6. User Awareness: Train users to recognize and avoid executing suspicious files, as user execution is a known infection vector. 7. Incident Response Preparation: Develop and rehearse ransomware-specific response plans, including forensic analysis to identify encrypted ransom notes and alternative communication channels with attackers if necessary. 8. Monitor Scheduled Tasks and Persistence Mechanisms: Regularly audit scheduled tasks and startup entries to detect unauthorized changes consistent with T1053.005. 9. Network Monitoring: Implement network traffic analysis to detect SMB scanning and unusual lateral movement attempts. 10. Restrict Administrative Privileges: Enforce least privilege principles to limit ransomware’s ability to propagate and encrypt critical systems.

DEVMAN Ransomware: Analysis of New DragonForce Variant

Description

Impact

Defensive guidance

Indicators of compromise

Hashes 4

Community reviews

Description

AI analysisMachine-generated, updated 2 Jul 2025, 07:40 UTC

MITRE ATT&CK techniques9 from threat tags

Technical details

Indicators of compromise

Hashes 4

Community reviews

Related threats