Introduction
In one of the most high-profile cyberattacks in Southeast Asia this year, a ransomware group known as DEVMAN has claimed responsibility for a devastating breach of the Thailand Ministry of Labour. This attack not only crippled critical digital infrastructure but also exposed sensitive citizen and government data to the world. Here's everything you need to know about the DEV-MAN ransomware group, their methods, and the implications of this recent assault.
Who is DEVMAN?
DEV-MAN is an emerging ransomware-as-a-service (RaaS) group first detected in April 2025. Believed to be affiliated with codebases from infamous ransomware families such as DragonForce, Conti, and Qilin, DEVMAN has been actively targeting both public and private sector entities across the globe.
The group operates with a clear objective: disrupt, exfiltrate, encrypt, and extort. Like many modern threat actors, DEV-MAN utilizes double extortion tactics, meaning they not only lock files but also steal sensitive data and threaten to publish it if the ransom is not paid.
According to threat intelligence from Ransomware.live, the top five countries most targeted and monthly statistics showing how many attacks are carried out by DEVMAN include:
- South Africa
- Thailand
- Japan
- Singapore
- China
These attacks span a range of sectors, underscoring the global and indiscriminate nature of DEVMAN’s operations.
The Thailand Ministry of Labour Breach
On July 16, 2025, the Ministry of Labour’s website (mol.go.th) was defaced with a message from DEVMAN, claiming responsibility for a calculated, long-term infiltration. According to their statement, the group had maintained access to the ministry’s internal systems for over 43 days prior to executing the attack.
Damage Report:
- Documents Exfiltrated: Over 300 GB
- Laptops Encrypted: Approximately 2,000
- Linux Servers Encrypted: 98+
- Windows Servers Encrypted: 50+
- Citizen Datasets: Dumped and exfiltrated
- Foreign Visitor Data: Exfiltrated
- Secret Government Documents: Over 600
- Active Directory Environment: Completely wiped
- Tape Backups: Destroyed
Attackers also added an onion link on the ransom note they published on the website. Upon visiting the link via the Tor browser, it was revealed that multiple companies and government institutions had already had their data published, while others were pending. Specifically, in the case of the Thailand Ministry of Labour, the attackers claim to have exfiltrated 300 GB of sensitive government data. They are demanding a ransom of $15 million USD, and have provided a Bitcoin address for payment, threatening full disclosure of the stolen data if their demands are not met.
This wasn't just a surface-level hit. The group demonstrated in-depth knowledge of internal architecture and conducted coordinated attacks on both Linux and Windows infrastructure, severely impairing operations.
The Ransomware Payload
The DEV-MAN ransomware is typically distributed through phishing emails, compromised RDP (Remote Desktop Protocol), or previously exploited vulnerabilities. Once inside a network, it spreads laterally, encrypting files with a unique extension often .devman, .devmanv1, or randomized variations.
Each encrypted system receives a ransom note, which includes:
- Instructions to access a .onion (Tor) website
- A custom victim ID for negotiation
- A deadline before data is publicly leaked
- A Bitcoin address for payment
DEV-MAN’s onion site serves as both a negotiation platform and a public shaming blog, where stolen data from non-paying victims is published.
Why This Attack Matters
This breach is not just a national security concern for Thailand , it’s a wake-up call to governments and enterprises across the region. Ransomware actors like DEV-MAN are technically sophisticated , well-funded and willing to attack essential public infrastructure
This also highlights the growing trend of ransomware groups targeting state institutions, not just for financial gain but potentially for political leverage.
What You Can Do
Maintain Immutable, Offline Backups
One of the most effective defenses against ransomware is having a reliable backup system. These backups should be stored offline (disconnected from the main network) and configured to be immutable, meaning they cannot be modified or deleted even by someone with admin access. Regularly test your backups to ensure they can be restored quickly in the event of an attack. Without this, recovery becomes nearly impossible if your data is encrypted or deleted.
Patch Vulnerabilities Promptly
Ransomware groups like DEVMAN often exploit known vulnerabilities in software, operating systems, and devices. It's critical to apply security patches as soon as they are released especially for high-risk systems like VPNs, web servers, and remote desktop tools. Delays, even by days or weeks, can leave the door open to an attack.
Limit and Monitor Remote Access
Remote access tools like RDP are common entry points for ransomware operators. You should disable them entirely if they are not essential. If remote access is required, ensure it's protected with multi-factor authentication (MFA), strong passwords, and IP allow lists. Also, monitor for unusual login patterns or failed access attempts, which may signal an ongoing intrusion attempt.
Final Thoughts
The DEVMAN ransomware group has quickly escalated to become a global cyber threat. With their recent takedown of Thailand’s Ministry of Labour, it’s clear that no entity is too big or too protected to be a target.
Governments and enterprises must treat ransomware threats with the seriousness they deserve. The age of simple viruses is long gone , we are now facing digital warfare waged by shadowy, well-coordinated cybercriminal syndicates.
Stay Informed. Stay Secure.
