Ransomware Group: DEVMAN

VICTIM NAME: Singapour Factory

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the DEVMAN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak pertains to a manufacturing entity located in Singapore, identified as “Singapour Factory.” The attack was detected on May 1, 2025, and the incident involved comprehensive encryption of the organization’s network data. There are no specific details available about the nature of the compromised data, and the description states “TBD” indicating that further information has not yet been disclosed. The leak page does not contain any screenshots or downloadable data at this time, but it indicates that the entire network was encrypted by the threat group known as “devman.”

The incident appears to be part of a broader campaign targeting industrial manufacturing facilities in the region. The attack methodology likely involved encrypting all accessible network data to extort a ransom from the victim organization, although the current leak does not specify whether a ransom demand was made or received. The reporting includes minimal contextual details, emphasizing the need for ongoing monitoring and security measures to prevent further compromises in the manufacturing sector within the country. No personally identifiable information or sensitive company data have been publicly revealed through this leak at this time.