The Funky Mantis extortion group has transformed an ordinary file-encryption toolkit into a fully fledged commercial service. Members now manage affiliates, sell access to compromised networks, and oversee negotiations with victims. Researchers have found indications that the operation has moved beyond development. It has been used in at least one genuine attack. An Operation Built Like a Business Funky Mantis, also known as DevMan, operates under the ransomware-as-a-service model.