RansomwareSOCRadar source-of-truth import; pending cross-source consensus confidenceSynced actor recordProfile updated Jul 05, 2026, 3:38 AM EDT

Apos

Apos emerged in April 2024 as a financially motivated threat group distinguished by its operation as a data-broker or leak-only entity, foregoing traditional file encryption in favor of data exfiltration and threatening to publicize or sell stolen information. While initial activity was noted to taper off, the group has been observed seeking penetration testers for its affiliate programs, suggesting a potential professionalization or expansion of its operations. Some reporting suggests the group consists of Russian-speaking members, though their geographical base remains unconfirmed.

This profile is generated from the same canonical actor-card record used by the Threat Actor Cards directory, so aliases, targeting fields, activity notes, and source links stay aligned as the database is enriched.

Actor Card Detail

Canonical Profile Fields

Entity Type¹

Ransomware profile

First Seen¹

2024-04-29

Last Seen¹

2025-08-15

Profile Updated¹

Jul 05, 2026, 3:38 AM EDT

Victim Count^1,2

Not available

Origin¹

Unknown

Motivation¹

Financially motivated ransomware/extortion

Primary Access Pattern¹

Not available

Objective¹

Financially motivated ransomware/extortion

Identity

Aliases And Boundaries

Aliases¹

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

Not available

Target Sectors^1,2

Construction of BuildingsOther Information ServicesSoftware PublishersAir TransportationManufacturingPublic AdministrationEducational ServicesWholesale TradeData Processing ServicesSpace & DefenseInsurancePharmaceutical and Medicine ManufacturingAircraft ManufacturingSpecialized Design ServicesComputer Systems Design and Related ServicesPhotographic ServicesOffice Administrative ServicesPublishing ServicesNational Security&International AffairsTruck&Rail TransportationTelecommunicationsRetailInformation ServicesComputer Design & ServicesBankingOtherFinanceProfessional&Technical ServicesHealthCare & Social AssistanceArts & EntertainmentAdministrative & Support ServicesHardware ManufacturingComputer Systems Design Services

Associated Activity¹

Initial Execution: Execution checks file creation access by attempting to create a temporary file, such as `__tmp_rar_sfx_access_check_*`, in the same directory as the malware executable.Deployment & Persistence: Presence of specific dynamic link libraries (DLLs) in the malware's directory, including libffi-8.dll, libgcc_s_dw2-1.dll, libgio-2.0-0.dll, libglib-2.0-0.dll, libgmodule-2.0-0.dll, libgobject-2.0-0.dll, libiconv-2.dll, libintl-8.dll, libpcre2-8-0.dll, and libwinpthread-1.dll, which are used for payload delivery and establishing persistence.Defense Evasion: Masquerading as legitimate software components or processes, such as mimicking Chrome extension updates, to blend into normal system activity.Command and Control: Observed network traffic patterns indicative of credential theft, system reconnaissance, and command-and-control (C2) communications, potentially disguised as legitimate traffic.

ATT&CK IDs¹

Not available

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 976²IntelliOS retained 59^{2,1,3,4,5,6,7,8,9,10}

SOCRadar reports 976 IOCs for this profile. IntelliOS currently retains 59 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 11 source groups tracked; 11 currently contribute retained observable or context rows.

Retained Observables

Showing 59 of 59

Type	Value	Source
File Extension	.DEVMAN extension⁶	DEVMAN
Tool / Process	Asia-Pacific market emphasis³	WatchGuard ransomware tracker
Tool / Process	Data theft and encryption pressure via affiliate operations⁵	Threat group profile
Tool / Process	Data-broker style extortion³	WatchGuard ransomware tracker
Tool / Process	DevMan multi-platform affiliate behavior⁵	Threat group profile
Tool / Process	Direct extortion³	WatchGuard ransomware tracker
Tool / Process	Do not merge APOS platform row into DevMan operator row automatically²	SOCRadar
Tool / Process	Double-extortion pressure³	WatchGuard ransomware tracker
Tool / Process	DragonForce code lineage context⁵	Threat group profile
Tool / Process	Initial access through phishing/social engineering¹⁰	Ransomware trends and initial access patterns
Tool / Process	Initial access through public-facing application exposure¹⁰	Ransomware trends and initial access patterns
Tool / Process	Initial access through valid credentials¹⁰	Ransomware trends and initial access patterns
Tool / Process	Leak-only operation context⁴	Apos ransomware group profile
Tool / Process	RaaS affiliate platform context⁵	Threat group profile
Tool / Process	Small-to-mid-sized enterprise targeting³	WatchGuard ransomware tracker
Tool / Process	Tracker-only confidence boundary for APOS-specific raw IOC counts²	SOCRadar
ATT&CK ID	T1005 - Data from Local System¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1039 - Data from Network Shared Drive¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1041 - Exfiltration Over C2 Channel¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1059 - Command and Scripting Interpreter¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1078 - Valid Accounts¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1083 - File and Directory Discovery¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1190 - Exploit Public-Facing Application¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1486 - Data Encrypted for Impact / affiliate context⁶	DEVMAN
ATT&CK ID	T1566 - Phishing¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1567 - Exfiltration Over Web Service¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1657 - Financial Theft / extortion-pressure context¹⁰	Ransomware trends and initial access patterns
Alias / Related Name	Apos²	SOCRadar
Alias / Related Name	Apos data-broker operation²	SOCRadar
Alias / Related Name	APOS ransomware²	SOCRadar
Alias / Related Name	Apos Security²	SOCRadar
Alias / Related Name	DevMan affiliate context⁵	Threat group profile
Malware Family	DevMan ransomware⁶	DEVMAN
Malware Family	DragonForce-derived ransomware context⁶	DEVMAN
Malware Family	Qilin affiliate/platform context⁵	Threat group profile
Malware Family	RansomHub affiliate/platform context⁵	Threat group profile
Campaign Context	April-July 2025: DevMan affiliate/operator reporting linked activity across Qilin, APOS, DragonForce, and RansomHub platforms.⁷	DevMan ransomware threat actor report
Campaign Context	IntelliOS excludes raw victim lists, leaked files, leak-site URLs, contact IDs, Tox IDs, ransom notes, negotiation material, payment information, raw credentials/access data, and unsupported claims from the APOS card.	Retained source
Campaign Context	November 2024: WatchGuard first-seen date for Apos Security as a data-broker extortion entry.³	WatchGuard ransomware tracker
CLASSIFICATION	RansomLook describes Apos as a data-broker or leak-only operation rather than a traditional file-encryption ransomware family.⁴	Apos ransomware group profile
CLASSIFICATION	SOCRadar retains Apos as a ransomware actor row; WatchGuard tracks Apos Security as a data-broker direct/double-extortion entry first seen in November 2024.³	WatchGuard ransomware tracker
OBSERVABLE	Analyst1 describes DevMan formalizing a RaaS platform after operating on modified DragonForce code; IntelliOS records this as operator/platform context, not APOS sample proof.⁸	Devman's RaaS launch
OBSERVABLE	CERT-IL reports DevMan as an affiliate of several RaaS programs, mainly Qilin, APOS, and DragonForce, while tracking at least 54 DevMan claims as of July 2025.⁷	DevMan ransomware threat actor report
OBSERVABLE	Vectra frames DevMan as part of recurring ransomware rebrand/lineage behavior from Conti to Black Basta to DevMan; IntelliOS uses that as lineage context only.⁹	From Conti to Black Basta to DevMan
OBSERVABLE	WatchGuard's Apos Security tracker row exposes raw TOR/Tox/contact material; IntelliOS intentionally excludes those raw channels.³	WatchGuard ransomware tracker
REGION	Africa⁴	Apos ransomware group profile
REGION	Asia⁴	Apos ransomware group profile
REGION	Asia-Pacific⁵	Threat group profile
REGION	Europe⁴	Apos ransomware group profile
REGION	Global exposure⁴	Apos ransomware group profile
SECTOR	Construction⁴	Apos ransomware group profile
SECTOR	Consumer services⁴	Apos ransomware group profile
SECTOR	Healthcare⁴	Apos ransomware group profile
SECTOR	Organizations represented in leak-site claims⁴	Apos ransomware group profile
SECTOR	Public services⁴	Apos ransomware group profile
SECTOR	Small and midsize enterprises⁵	Threat group profile
SECTOR	Technology⁴	Apos ransomware group profile
SOURCE_BOUNDARY	APOS-specific public technical artifacts are thin; stronger malware-detail sources currently describe DevMan/DragonForce lineage rather than standalone APOS samples.⁶	DEVMAN
SOURCE_BOUNDARY	Halcyon and CERT-IL place DevMan as an affiliate/operator context across Qilin, DragonForce, Apos, and RansomHub; IntelliOS does not merge the APOS platform row into the DevMan actor row automatically.⁵	Threat group profile

Source	Reported	Retained	Coverage Status
SOCRadar²	976	6	Reported IOC count and SOCRadar-backed observable rows retained in IntelliOS.
SOCRadar¹	N/A	1	Public observables or source-context rows retained and displayed.
SOCRadar²	N/A	6	Public observables or source-context rows retained and displayed.
WatchGuard³	N/A	8	Public observables or source-context rows retained and displayed.
RansomLook⁴	N/A	12	Public observables or source-context rows retained and displayed.
Halcyon⁵	N/A	10	Public observables or source-context rows retained and displayed.
Broadcom⁶	N/A	5	Public observables or source-context rows retained and displayed.
Israel National Cyber Directorate / CERT-IL⁷	N/A	2	Public observables or source-context rows retained and displayed.
Analyst1⁸	N/A	1	Public observables or source-context rows retained and displayed.
Vectra AI⁹	N/A	1	Public observables or source-context rows retained and displayed.
Red Canary¹⁰	N/A	13	Public observables or source-context rows retained and displayed.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Apos	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Apos	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Baseline actor-card corpus source for retained profile fields.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/apos	Per-actor SOCRadar profile source for ransomware profile metadata and IOC count when available.
3	WatchGuard ransomware tracker: Apos Security https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/apos-security	Ransomware Tracker
4	Apos ransomware group profile https://www.ransomlook.io/group/apos	Ransomware Tracker
5	Threat group profile: DevMan https://www.halcyon.ai/threat-group/devman	Threat Actor Profile
6	DEVMAN: a new DragonForce ransomware variant https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant	Malware Analysis
7	DevMan ransomware threat actor report https://www.gov.il/BlobFolder/reports/alert_1907/he/ALERT-CERT-IL-W-1907.pdf	Government Threat Intelligence
8	Devman's RaaS launch https://analyst1.com/devmans-raas-launch-the-affiliate-who-aims-to-become-the-boss/	Threat Actor Reporting
9	From Conti to Black Basta to DevMan https://www.vectra.ai/blog/from-conti-to-black-basta-to-devman-the-endless-ransomware-rebrand	Ransomware Lineage Analysis
10	Ransomware trends and initial access patterns https://redcanary.com/threat-detection-report/trends/ransomware/	Ransomware Landscape Report

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Apos.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Loading Threat Actor Cards

Apos

Canonical Profile Fields

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Linked Products

How IntelliOS Keeps The Labels Straight

Source Notes

Open Interpretation Boundaries