RansomwareSOCRadar source-of-truth import; pending cross-source consensus confidence

Apos

Apos emerged in April 2024 as a financially motivated threat group distinguished by its operation as a data-broker or leak-only entity, foregoing traditional file encryption in favor of data exfiltration and threatening to publicize or sell stolen information. While initial activity was noted to taper off, the group has been observed seeking penetration testers for its affiliate programs, suggesting a potential professionalization or expansion of its operations. Some reporting suggests the group consists of Russian-speaking members, though their geographical base remains unconfirmed.

Directory Briefing

Top 10 Talking Points

Apos is tracked as an affiliate-enabled ransomware service.¹

The brand supplies shared capabilities, but affiliates can change access methods and tooling; incident scoping should follow observed behavior rather than assume one fixed playbook.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems.¹

Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

Retained targeting includes Construction of Buildings, Other Information Services, Software Publishers, Air Transportation, and Manufacturing across Argentina, Australia, Brazil, and Canada; translate those sectors into the organization's exposed systems and high-value data.

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Bottom Line Up Front

BLUF

Apos is tracked as an affiliate-enabled ransomware service.¹

The brand supplies shared capabilities, but affiliates can change access methods and tooling; incident scoping should follow observed behavior rather than assume one fixed playbook.

Initial access should be scoped across identity and Internet-facing systems.^1,2

The retained behavior points to credentials, remote access, phishing, or exposed services; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

The first detected host should not define the compromise boundary.¹

Check for earlier credential use, remote sessions, administrative changes, and data access because public actor records often understate the full pre-impact timeline.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The likely objective is control of high-value systems.¹

Lateral movement, administrative access, and shared server infrastructure can turn a limited foothold into broad business interruption.

Behavioral telemetry is more durable than a malware hash.¹

Prioritize unusual process ancestry, remote execution, account use, network paths, and administrative changes because tooling can change faster than the actor's operational requirements.

Preserve independent telemetry before containment changes the scene.¹

Endpoint, identity, network, cloud, email, and backup logs provide the cross-check needed when the actor's public record does not clearly describe defense evasion.

This is a data-breach problem as well as a recovery problem.¹

Collection or exfiltration behavior includes data staging and exfiltration; counsel and forensics need a shared record of what was accessed, staged, and transferred.

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Align counsel, forensics, identity, recovery, insurance, communications, and regulatory analysis around one compromise timeline and one evidence-preservation plan.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

Ransomware profile

First Seen¹

2024-04-29

Last Seen¹

2025-08-15

Origin¹

Motivation¹

Financially motivated ransomware/extortion

Primary Access Pattern¹

Not available

Objective¹

Financially motivated ransomware/extortion

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Source Boundary

SOCRadar is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure^1,2

ArgentinaAustraliaBrazilCanadaCzech RepublicGermanySpainFranceUnited KingdomIndiaPolandParaguaySingaporeUnited StatesUruguaySouth Africa

Target Sectors^1,2

Construction of BuildingsOther Information ServicesSoftware PublishersAir TransportationManufacturingPublic AdministrationEducational ServicesWholesale TradeData Processing ServicesSpace & DefenseInsurancePharmaceutical and Medicine ManufacturingAircraft ManufacturingSpecialized Design ServicesComputer Systems Design and Related ServicesPhotographic ServicesOffice Administrative ServicesPublishing ServicesNational Security&International AffairsTruck&Rail TransportationTelecommunicationsRetailInformation ServicesComputer Design & ServicesBankingOtherFinanceProfessional&Technical ServicesHealthCare & Social AssistanceArts & EntertainmentAdministrative & Support ServicesHardware ManufacturingComputer Systems Design Services

Associated Activity¹

Initial Execution: Execution checks file creation access by attempting to create a temporary file, such as `__tmp_rar_sfx_access_check_*`, in the same directory as the malware executable.Deployment & Persistence: Presence of specific dynamic link libraries (DLLs) in the malware's directory, including libffi-8.dll, libgcc_s_dw2-1.dll, libgio-2.0-0.dll, libglib-2.0-0.dll, libgmodule-2.0-0.dll, libgobject-2.0-0.dll, libiconv-2.dll, libintl-8.dll, libpcre2-8-0.dll, and libwinpthread-1.dll, which are used for payload delivery and establishing persistence.Defense Evasion: Masquerading as legitimate software components or processes, such as mimicking Chrome extension updates, to blend into normal system activity.Command and Control: Observed network traffic patterns indicative of credential theft, system reconnaissance, and command-and-control (C2) communications, potentially disguised as legitimate traffic.

ATT&CK IDs¹

Not available

Campaign Context

Associated Campaigns / Operations

No source-backed campaign or named operation association is currently retained for this actor card. Related campaign rows will appear here when SOCRadar, MITRE ATT&CK Campaigns, Microsoft, Google/Mandiant, CrowdStrike, CISA, or another retained public source ties the actor to a named campaign or operation.

Indicators

IOCs And Observable Retention

SOCRadar reported 976²IntelliOS retained 59^{2,1,3,4,5,6,7,8,9,10}

SOCRadar reports 976 IOCs for this profile. IntelliOS currently retains 59 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 11 source groups tracked; 11 currently contribute retained observable or context rows.

Retained Observables

Showing 59 of 59

Type	Value	Source
File Extension	.DEVMAN extension⁶	DEVMAN
Tool / Process	Asia-Pacific market emphasis³	WatchGuard ransomware tracker
Tool / Process	Data theft and encryption pressure via affiliate operations⁵	Threat group profile
Tool / Process	Data-broker style extortion³	WatchGuard ransomware tracker
Tool / Process	DevMan multi-platform affiliate behavior⁵	Threat group profile
Tool / Process	Direct extortion³	WatchGuard ransomware tracker
Tool / Process	Do not merge APOS platform row into DevMan operator row automatically²	SOCRadar
Tool / Process	Double-extortion pressure³	WatchGuard ransomware tracker
Tool / Process	DragonForce code lineage context⁵	Threat group profile
Tool / Process	Initial access through phishing/social engineering¹⁰	Ransomware trends and initial access patterns
Tool / Process	Initial access through public-facing application exposure¹⁰	Ransomware trends and initial access patterns
Tool / Process	Initial access through valid credentials¹⁰	Ransomware trends and initial access patterns
Tool / Process	Leak-only operation context⁴	Apos ransomware group profile
Tool / Process	RaaS affiliate platform context⁵	Threat group profile
Tool / Process	Small-to-mid-sized enterprise targeting³	WatchGuard ransomware tracker
Tool / Process	Tracker-only confidence boundary for APOS-specific raw IOC counts²	SOCRadar
ATT&CK ID	T1005 - Data from Local System¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1039 - Data from Network Shared Drive¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1041 - Exfiltration Over C2 Channel¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1059 - Command and Scripting Interpreter¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1078 - Valid Accounts¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1083 - File and Directory Discovery¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1190 - Exploit Public-Facing Application¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1486 - Data Encrypted for Impact / affiliate context⁶	DEVMAN
ATT&CK ID	T1566 - Phishing¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1567 - Exfiltration Over Web Service¹⁰	Ransomware trends and initial access patterns
ATT&CK ID	T1657 - Financial Theft / extortion-pressure context¹⁰	Ransomware trends and initial access patterns
Alias / Related Name	Apos²	SOCRadar
Alias / Related Name	Apos data-broker operation²	SOCRadar
Alias / Related Name	APOS ransomware²	SOCRadar
Alias / Related Name	Apos Security²	SOCRadar
Alias / Related Name	DevMan affiliate context⁵	Threat group profile
Malware Family	DevMan ransomware⁶	DEVMAN
Malware Family	DragonForce-derived ransomware context⁶	DEVMAN
Malware Family	Qilin affiliate/platform context⁵	Threat group profile
Malware Family	RansomHub affiliate/platform context⁵	Threat group profile
Campaign Context	April-July 2025: DevMan affiliate/operator reporting linked activity across Qilin, APOS, DragonForce, and RansomHub platforms.⁷	DevMan ransomware threat actor report
Campaign Context	IntelliOS excludes raw victim lists, leaked files, leak-site URLs, contact IDs, Tox IDs, ransom notes, negotiation material, payment information, raw credentials/access data, and unsupported claims from the APOS card.	Retained source
Campaign Context	November 2024: WatchGuard first-seen date for Apos Security as a data-broker extortion entry.³	WatchGuard ransomware tracker
CLASSIFICATION	RansomLook describes Apos as a data-broker or leak-only operation rather than a traditional file-encryption ransomware family.⁴	Apos ransomware group profile
CLASSIFICATION	SOCRadar retains Apos as a ransomware actor row; WatchGuard tracks Apos Security as a data-broker direct/double-extortion entry first seen in November 2024.³	WatchGuard ransomware tracker
OBSERVABLE	Analyst1 describes DevMan formalizing a RaaS platform after operating on modified DragonForce code; IntelliOS records this as operator/platform context, not APOS sample proof.⁸	Devman's RaaS launch
OBSERVABLE	CERT-IL reports DevMan as an affiliate of several RaaS programs, mainly Qilin, APOS, and DragonForce, while tracking at least 54 DevMan claims as of July 2025.⁷	DevMan ransomware threat actor report
OBSERVABLE	Vectra frames DevMan as part of recurring ransomware rebrand/lineage behavior from Conti to Black Basta to DevMan; IntelliOS uses that as lineage context only.⁹	From Conti to Black Basta to DevMan
OBSERVABLE	WatchGuard's Apos Security tracker row exposes raw TOR/Tox/contact material; IntelliOS intentionally excludes those raw channels.³	WatchGuard ransomware tracker
REGION	Africa⁴	Apos ransomware group profile
REGION	Asia⁴	Apos ransomware group profile
REGION	Asia-Pacific⁵	Threat group profile
REGION	Europe⁴	Apos ransomware group profile
REGION	Global exposure⁴	Apos ransomware group profile
SECTOR	Construction⁴	Apos ransomware group profile
SECTOR	Consumer services⁴	Apos ransomware group profile
SECTOR	Healthcare⁴	Apos ransomware group profile
SECTOR	Organizations represented in leak-site claims⁴	Apos ransomware group profile
SECTOR	Public services⁴	Apos ransomware group profile
SECTOR	Small and midsize enterprises⁵	Threat group profile
SECTOR	Technology⁴	Apos ransomware group profile
SOURCE_BOUNDARY	APOS-specific public technical artifacts are thin; stronger malware-detail sources currently describe DevMan/DragonForce lineage rather than standalone APOS samples.⁶	DEVMAN
SOURCE_BOUNDARY	Halcyon and CERT-IL place DevMan as an affiliate/operator context across Qilin, DragonForce, Apos, and RansomHub; IntelliOS does not merge the APOS platform row into the DevMan actor row automatically.⁵	Threat group profile

Source	Reported	Retained	Coverage Status
SOCRadar²	976	6	Reported IOC count and SOCRadar-backed observable rows retained in IntelliOS.
SOCRadar¹	N/A	1	Public observables or source-context rows retained and displayed.
SOCRadar²	N/A	6	Public observables or source-context rows retained and displayed.
WatchGuard³	N/A	8	Public observables or source-context rows retained and displayed.
RansomLook⁴	N/A	12	Public observables or source-context rows retained and displayed.
Halcyon⁵	N/A	10	Public observables or source-context rows retained and displayed.
Broadcom⁶	N/A	5	Public observables or source-context rows retained and displayed.
Israel National Cyber Directorate / CERT-IL⁷	N/A	2	Public observables or source-context rows retained and displayed.
Analyst1⁸	N/A	1	Public observables or source-context rows retained and displayed.
Vectra AI⁹	N/A	1	Public observables or source-context rows retained and displayed.
Red Canary¹⁰	N/A	13	Public observables or source-context rows retained and displayed.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
SOCRadar	Apos	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Apos	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Apos.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	SOCRadar Threat Actor Database https://socradar.io/free-tools/threat-actor/ransomware	Threat actor directory source for profile fields and reported activity.
2	SOCRadar Actor Profile https://socradar.io/free-tools/ransomware-intelligence/groups/apos	Actor-specific source for ransomware profile metadata and reported IOC counts when available.
3	WatchGuard ransomware tracker: Apos Security https://www.watchguard.com/wgrd-security-hub/ransomware-tracker/apos-security	Ransomware Tracker
4	Apos ransomware group profile https://www.ransomlook.io/group/apos	Ransomware Tracker
5	Threat group profile: DevMan https://www.halcyon.ai/threat-group/devman	Threat Actor Profile
6	DEVMAN: a new DragonForce ransomware variant https://www.broadcom.com/support/security-center/protection-bulletin/devman-a-new-dragonforce-ransomware-variant	Malware Analysis
7	DevMan ransomware threat actor report https://www.gov.il/BlobFolder/reports/alert_1907/he/ALERT-CERT-IL-W-1907.pdf	Government Threat Intelligence
8	Devman's RaaS launch https://analyst1.com/devmans-raas-launch-the-affiliate-who-aims-to-become-the-boss/	Threat Actor Reporting
9	From Conti to Black Basta to DevMan https://www.vectra.ai/blog/from-conti-to-black-basta-to-devman-the-endless-ransomware-rebrand	Ransomware Lineage Analysis
10	Ransomware trends and initial access patterns https://redcanary.com/threat-detection-report/trends/ransomware/	Ransomware Landscape Report

Loading Threat Actor Cards

Apos

Top 10 Talking Points

Apos is tracked as an affiliate-enabled ransomware service.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems.1

Behavioral telemetry is more durable than a malware hash.1

Preserve independent telemetry before containment changes the scene.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

BLUF

Apos is tracked as an affiliate-enabled ransomware service.1

Initial access should be scoped across identity and Internet-facing systems.1,2

The first detected host should not define the compromise boundary.1

Identity compromise is a central scoping issue.1

The likely objective is control of high-value systems.1

Behavioral telemetry is more durable than a malware hash.1

Preserve independent telemetry before containment changes the scene.1

This is a data-breach problem as well as a recovery problem.1

Victimology is broad enough that sector alone is weak negative evidence.1,2

The first briefing should connect outage, stolen data, and extortion leverage.1,2

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Apos is tracked as an affiliate-enabled ransomware service.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Preserve independent telemetry before containment changes the scene.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2

Apos is tracked as an affiliate-enabled ransomware service.¹

Initial access should be scoped across identity and Internet-facing systems.^1,2

The first detected host should not define the compromise boundary.¹

Identity compromise is a central scoping issue.¹

The likely objective is control of high-value systems.¹

Behavioral telemetry is more durable than a malware hash.¹

Preserve independent telemetry before containment changes the scene.¹

This is a data-breach problem as well as a recovery problem.¹

Victimology is broad enough that sector alone is weak negative evidence.^1,2

The first briefing should connect outage, stolen data, and extortion leverage.^1,2