🎯 A fixed target set. A kernel service. Endpoint defenses taken offline before encryption. Because ransomware deployment is easier when the security software is no longer running.
This is PHANTOM MANTIS (a.k.a. The Gentlemen) before the ransom note. We have been tracking
⚠️ DevMan RaaS now runs a full affiliate portal.
Experts (tracking it as Funky Mantis) say the platform handles payload builds, victim records, chat, teams, support, and payouts in one place. Affiliates get structured workflows, deadlines, and an 80/20 cut.
184 victims claimed
🎯 A target list. A schedule. A revenue model. A locker ready to deploy.
This is Funky Mantis (DevMan) behind the ransom note.
🕵 Our latest report reveals how the operation assigns access, schedules targets, divides responsibilities, and coordinates through
🚨 PHANTOM MANTIS (a.k.a. The Gentlemen): They only hold the door open to exfiltrate your data.
Meet Phantom Mantis, the ransomware crew that went from total unknown to one of the most prolific operations. 💀
🔥 HUNDREDS of victims on their leak site
🌍 Confirmed hits across
This is what happens when you put an ex-hacker on a stage in front of 750 students. 👨🎓👩🎓
Last week, we had the privilege of being part of two remarkable events and we're still feeling the energy.
We participated in the Leiden 2026 Youth Security Conference, where the next
