[DEVMAN] – Ransomware Victim: pharmaciedesalizes[.]fr

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the DEVMAN Onion Dark Web Tor Blog page.

Ransomware group:
DEVMAN
Victim name:
PHARMACIEDESALIZES[.]FR

AI Generated Summary of the Ransomware Leak Page

pharmaciedesalizes.fr, a French healthcare organization, is listed as a ransomware victim on a leak page attributed to the threat actor group devman. The post is dated 2025-10-17 16:21:05.950783 and describes a data-leak scenario rather than a straightforward encryption event. The attackers claim to have exfiltrated around 80 GB of data from the victim’s network and are demanding a ransom of 50k USD. The leak page includes 35 image attachments that appear to be screenshots or internal documents used to illustrate the breach; the actual image URLs are not included in the public write-up. The body text contains a mixture of data sizes and ransom figures, consistent with double-extortion tactics, and references time-based notes in the text that imply countdowns around the ransom demands.

The page also features a bilingual section. The Russian-language portion condemns violence against CIS-based companies and states that the group is developing a program to defend regional firms from such incidents. It invites individuals with access to systems in Ukraine, Russia, Georgia, or companies owned by people from the CIS to contact the actors via a forum-based Tox contact; the attackers promise a reward for providing access and stress that brute-force methods or the use of stealers are unacceptable. The English translation reiterates the reward-for-access theme and notes additional negotiation conditions, including a minimum deposit (reported as 10k USD) and a promise that a forthcoming version (V2.1) will be released in about a week. The text also instructs would-be participants to present data volumes of at least 100 GB if they initiate contact. Taken together, the content reveals a complex extortion operation that blends data-leak claims with recruitment-style messaging and a formalized negotiation framework, which heightens risk for healthcare targets by expanding potential pathways for data exposure and illicit access.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features