Ransomware Group: DEVMAN

VICTIM NAME: smvthailand[.]com

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the DEVMAN Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The ransomware leak page pertains to the domain smvthailand.com. The incident was discovered on May 2, 2025, with the attack date also recorded as May 2, 2025. The threat actors, identified by the group name devman, reportedly encrypted all network servers associated with the victim. The breach involved the theft of approximately 25 gigabytes of sensitive data, including confidential files. The ransom demanded was estimated at 375,000 USD. The attackers claimed to have exfiltrated critical information prior to encryption, potentially impacting the victim’s operations and data integrity.

The leak page indicates that no information related to employee or third-party data was involved, and no active information stealer statistics are available. Although the page does not include screenshots or direct download links, it references the encrypted sensitive files and the stolen data as part of the extortion. The attack was geographically centered in Thailand, but no activity details beyond the ransom and data compromise are provided. Overall, the page highlights a significant security breach involving comprehensive server encryption and data theft, underscoring the seriousness of the incident without revealing specific technical or personal details.