Ransomware Group: DEVMAN

VICTIM NAME: sol*d*r*[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the DEVMAN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to a victim within the technology sector, identified as a domain associated with the name “sol*d*r*.com.” The incident is reported to have occurred on July 12, 2025. The leak was discovered shortly after the attack, during the same day. The threat group responsible for this operation is identified as “devman.” The reported ransom amount demanded or associated with the breach is approximately 7,250,000 USD. The page indicates the presence of a claim URL, which is accessible via an anonymous deep web link, and suggests that data may have been leaked or compromised.

The leak page does not specify the type or extent of the compromised data but references the attack date and the potential for data exposure. Although there are no visible screenshots or detailed descriptions provided, the page suggests ongoing or completed data exfiltration activities. No detailed country information is available for the victim, and there is no mention of personally identifiable information being exposed. The focus appears to be on the financial demands and the leak claim, emphasizing the importance of monitoring for potential further data dissemination or blackmail activities related to this incident.