ctfc.cat listed on devman ransomware leak site

• Ransomware group: devman
• Country: Spain
• Announcement date: November 12, 2025

Devman claims data exfiltration against ctfc.cat

The threat actor group known as devman has officially listed the Spanish organization ctfc.cat on its ransomware leak site. According to the announcement made on November 12, 2025, the group claims to have successfully exfiltrated a significant amount of data from the target. This development follows a claimed attack date of November 12, 2025, suggesting a rapid transition from the initial intrusion to the public listing on the group's platform.

The devman group is currently operating with a high degree of anonymity, as information regarding this specific threat actor remains limited in the public domain. While the group has taken responsibility for the incident, the exact methods used to gain access to the network have not been disclosed. The group is employing double extortion tactics, a common strategy in modern ransomware campaigns where attackers not only encrypt an organization's systems but also threaten to leak sensitive information on public forums to increase pressure on the victim.

Details of the alleged theft and ransom demand

The claims made by devman involve a specific volume of stolen information. The group asserts that the total size of the exfiltrated data is 30 GB. Despite the significant volume of data mentioned, the threat actor has not provided any detailed information regarding the specific content or the types of files that were allegedly stolen during the breach.

• The listing names no specific data types or individual file categories.

In addition to the threat of data publication, the group has issued a ransom demand. The attackers are demanding a payment of 248,000. This demand serves as the primary leverage in their extortion attempt, aiming to force the organization into a financial settlement to prevent the public release of the 30 GB of data.

About ctfc.cat

The target of this alleged attack, ctfc.cat, is the Forest Science and Technology Centre of Catalonia. This research center is based in Spain and plays a specialized role in the scientific community. The organization focuses its research efforts on forest sciences, ecosystem management, and biodiversity. Furthermore, the center conducts various projects aimed at sustainable forest management and the development of rural areas.

Potential risks and organizational implications

The claims made by devman could pose significant risks to the operational continuity and data privacy of the organization. Because ctfc.cat is based in Spain, any confirmed breach of this nature could lead to complex legal proceedings and administrative sanctions under the General Data Protection Regulation (GDPR). The potential exposure of sensitive research or administrative data carries heavy regulatory weight in the European Union.

Beyond legal and regulatory consequences, the publication of stolen data can trigger secondary risks. These include the possibility of identity theft or the execution of highly targeted phishing attacks aimed at the employees and various stakeholders of the organization. When attackers possess a large volume of data, they can craft much more convincing social engineering campaigns.

To mitigate such risks, organizations are generally advised to implement proactive monitoring to detect potential data breaches early. Reviewing and strengthening security measures is a critical step in defending against the evolving tactics used by ransomware groups. Maintaining robust backup strategies and ensuring that access controls are strictly enforced are standard defensive practices to protect against the impact of both encryption and data exfiltration.