[DEVMAN] – Ransomware Victim: o*c*u[.]o**

AI Generated Summary of the Ransomware Leak Page

On November 1, 2025, the leak page tied to the victim known as o*c*u.o**—a technology sector company—publicly documented a ransomware incident framed as a data-leak event. The post indicates a ransom demand of 500k and asserts that about 120 GB of data has been exfiltrated, with multiple data packages referenced in the body excerpt. The page is attributed to the threat group devman and includes a claim URL, signaling a public-extortion posture beyond a simple encryption incident. Because no explicit compromise date is provided in the post, the publication date (the post date) is used as the temporal anchor: 2025-11-01. The material aligns with typical double-extortion tactics, where stolen data is used as leverage alongside any encryption efforts, though the page does not state a confirmed encryption outcome for the victim’s systems.

The leak page presents a substantial visual and data footprint: it includes 39 image attachments, described here in general terms as screenshots and document visuals rather than a narrative of specific files. The attachments are hosted via onion-network addresses, but the URLs have been defanged in this summary. The body excerpt reads like a ledger of exfiltration activity, with references to data volumes such as 60 GB, 120 GB, and 400 GB and intermittent notes of “data theft” or “oracle theft,” accompanied by time-bound lines that imply progress indicators for exfiltration and corresponding ransom values. The page also notes a claim URL and invites recovery companies to contact the attackers through a secure channel, indicating an overt public-extortion stance.

Language on the page blends English and Russian content, including a bilingual message that references not only the extortion dynamics but also a recruitment-oriented angle. The English text frames negotiation and data monetization, while the Russian portion presents a recruitment pitch offering rewards for providing access to other networks, with cautions against brute-forcing. A future update reference (V2.1) and a forum contact alias (DevManager) are also present, suggesting a broader reach beyond the single victim and an intent to expand the attackers’ network. Taken together, the post depicts a data-leak extortion operation associated with the victim o*c*u.o** and highlights the ongoing risk to allied targets through recruitment and multi-target extortion activity.