Devos

Devos is a variant of Phobos ransomware, a type of malware that infects systems and holds data hostage for ransom. It is closely linked to other variants such as Elking, Eight, Backmydata, and Faust ransomware due to similar Tactics, Techniques, and Procedures (TTPs) observed in their intrusions. Open source reporting suggests that these variants, including Devos, are among the most common forms of Phobos ransomware based on frequency of appearance across analyzed samples. The affiliates of Devos, along with others like Eight, Elbie, Eking, and Faust, have been observed using various email providers, some of which include gmx[.]com, tutanota[.]com, aol[.]com, and protonmail[.]com. In addition to email, Devos affiliates have also used instant messaging applications like QQ[.]com, a Chinese platform, and ICQ, owned by a Russian company, for communication and possibly for coordinating attacks or sharing information. The Devos malware has been associated with numerous file extensions such as faust, actin, DIKE, Acton, and others. These extensions may be used to identify files that have been encrypted by the ransomware, marking them as inaccessible until a ransom is paid. It's important to note that this information is crucial for cybersecurity professionals aiming to protect systems from these types of threats and to develop effective countermeasures.