Devman Ransomware Recovery: The DragonForce Spin-off

Devman is a ransomware operation that runs its own leak site and lists more than 180 claimed victims on ransomware.live, many of them in Asia and Africa. Researchers at Intel 471, ANY.RUN and others assess its encryptor as a customised build of the DragonForce code base, which itself shares code with the leaked Conti ransomware. The ransom note closely copies DragonForce's.

The encryptor works offline, without contacting a command server, and tries to spread across the network through SMB shares. A builder mistake in some versions even encrypts its own ransom notes, a sign of a tool that is still being developed.

Devman supports three modes: full, header-only and custom. Full encryption is what most people imagine. Header-only encryption scrambles just the start of each file, and custom mode encrypts selected parts.

For a large file, header-only or partial damage is very different from total loss. The start of a SQL Server MDF, a VMDK or a Veeam VBK holds its descriptive information; the bulk of the data lies after it. With the right tools the header can be rebuilt or worked around, and the rest of the file read normally.

We check every encrypted file to see which mode was used and how much is intact, then recover database tables, virtual machine disks and backup contents from the readable parts. We have solved many header-encryption cases, including databases and VMs that looked completely lost.

Do not delete the encrypted files and do not reinstall the servers. Keep a copy and contact us for a free assessment: we tell you exactly what is recoverable before you pay anything.