As reported by The Hacker News, PRODAFT has pulled back the curtain on a sophisticated ransomware-as-a-service operation dubbed Funky Mantis, which operates a centralized web platform — branded DevMan — enabling affiliates to build customized payloads, track victim negotiations, and collect payouts, all from a single administrative interface.

Ransomware Alert: As reported by The Hacker News, PRODAFT has pulled back the curtain on a sophisticated ransomware-as-a-service operation dubbed Funky Mantis, which operates a centralized web platform — branded DevMan — enabling affiliates to build customized payloads, track victim negotiations, and collect payouts, all from a single administrative interface.

Why This Discovery Matters

The existence of a purpose-built, feature-rich affiliate portal is not itself novel — RaaS ecosystems have been commoditizing ransomware delivery for years. What makes DevMan operationally significant is the degree of vertical integration on display. When a criminal syndicate consolidates payload generation, victim management, and financial settlement into a single cohesive platform, it signals organizational maturity. This is no longer a loosely coordinated underground forum arrangement; it is a software business built around the ransomware economy.

This level of industrialization has two compounding effects that defenders must internalize:
  • Lower barrier to entry for affiliates: Aspiring ransomware operators no longer need technical depth to deploy attacks. The platform abstracts that complexity, effectively turning ransomware deployment into a point-and-click operation. Expect attack volume — not just sophistication — to increase.
  • Harder attribution and takedown: Centralized infrastructure, paradoxically, can be more resilient. If the core development team retains strict operational control over the portal, affiliates become semi-disposable, and law enforcement disruption of individual threat actors has diminishing impact on the broader operation.

The Broader RaaS Industrialization Trend

DevMan fits squarely within an accelerating trend we have observed across the threat landscape. Following the disruption of legacy RaaS brands like LockBit and ALPHV/BlackCat, a vacuum emerged that newer, leaner operations have been eager to fill. Funky Mantis appears designed from the ground up with affiliate experience in mind — optimizing for ease of use and payout reliability in ways that directly compete for talent with established criminal brands.

Shield53 Perspective: Criminal RaaS platforms are now benchmarking themselves against legitimate SaaS products. When an adversary invests in UX and payment infrastructure, they are signaling long-term operational intent — not a fleeting campaign.

Organizations in sectors that have historically been high-value ransomware targets — healthcare, manufacturing, financial services, and critical infrastructure — should treat the emergence of DevMan/Funky Mantis as a leading indicator of coming attack waves, not simply a research curiosity.

What Defenders Are Actually Up Against

The centralized build system described in PRODAFT's research deserves particular attention from blue teams. When affiliates can generate customized payloads on demand, static indicators of compromise (IOCs) — file hashes, specific strings, hardcoded command-and-control addresses — have an extremely short shelf life. Detection strategies anchored to signature-based controls will consistently lag behind payload variants produced by such systems.

Additionally, integrated victim management portals mean that ransom negotiation, data leak timing, and payment verification are all coordinated by the core operator group. This creates a more disciplined, consistent adversary on the other side of an incident — one that is less likely to make operational mistakes during the extortion phase.

Shield53 Recommendations

Immediate Actions

Shield53 Recommendations
Shift to behavior-based detection: Prioritize EDR rules and SIEM detections that flag ransomware-typical behaviors — mass file enumeration, shadow copy deletion, LSASS access, lateral movement via SMB — rather than relying on static IOC feeds that will be outdated within hours of a new build.
Audit and harden backup infrastructure: Ensure backups are air-gapped or immutable, tested for restoration integrity, and that backup credentials are not accessible from production environments. RaaS affiliates routinely target backup systems before detonating ransomware.
Review privileged access controls: Affiliate-driven attacks often leverage compromised credentials acquired through initial access brokers. Enforce MFA universally on privileged accounts and reduce standing administrative access using just-in-time provisioning.
Subscribe to threat intelligence feeds tracking RaaS affiliate activity: PRODAFT, Recorded Future, and similar vendors actively monitor criminal forums and infrastructure. This intelligence can provide early warning of targeting campaigns before payload deployment.
Conduct tabletop exercises simulating RaaS affiliate TTPs: Specifically rehearse scenarios involving double extortion — where data exfiltration has already occurred before encryption — so that leadership and legal teams understand the full scope of decisions they may face during an incident.

Longer-Term Strategic Posture

  • Implement network segmentation that limits blast radius if an affiliate gains initial access — flat networks remain the single greatest gift defenders can give ransomware operators.
  • Establish and regularly test an incident response retainer with a firm experienced in ransomware negotiations and forensic recovery, before you need it.
  • Monitor CISA's Known Exploited Vulnerabilities catalog and prioritize patching on internet-facing systems — initial access for RaaS affiliates most commonly originates from unpatched VPN appliances, RDP exposures, and public-facing application vulnerabilities.

The DevMan portal is a reminder that the ransomware ecosystem continues to evolve with the same velocity as legitimate enterprise software. Defenders who treat ransomware as a static, well-understood threat will consistently find themselves outpaced. The organizations that fare best are those that invest in adaptive detection capabilities, mature incident response processes, and continuous threat intelligence — not just perimeter controls.