Tawasol listed on devman ransomware leak site

• Ransomware group: devman
• Country: Egypt
• Sector: Professional Services
• Announcement date: April 13, 2025

Tawasol targeted by devman ransomware group

The devman ransomware group has officially listed the Egyptian professional services firm Tawasol on its leak site. According to the announcement made on April 13, 2025, the threat actors claim to have targeted the organization and are threatening to publish data allegedly belonging to the company if their demands are not met.

The details of the claim

The announcement made by the devman group outlines a specific extortion attempt. The group has stated its intention to publish the data they claim to have exfiltrated from Tawasol. Accompanying this threat is a ransom demand totaling 150,000 USD. The listing appeared on the group's leak site on April 13, 2025, marking the beginning of this public extortion phase.

Ransomware groups often use leak sites to apply psychological and reputational pressure on their victims. By publishing a countdown or a formal listing, these groups aim to force the organization into compliance through the fear of public exposure. This tactic is a hallmark of modern cyber extortion, where the threat of data exposure is used as a primary lever for negotiation.

Data and information status

Regarding the specifics of the alleged breach, the current information remains limited. The listing does not provide details concerning the nature of the leaked or threatened data. Furthermore, no information has been provided regarding the total size of the data or the specific file count involved in the incident. No screenshots or visual evidence of the stolen data have been made available to the public at this time.

About Tawasol

Tawasol is a professional services and business solutions company based in Egypt. The organization provides strategic consulting and operational support services to a diverse range of clients across various sectors. As a service provider, the company plays a role in supporting the operational and strategic needs of its client base.

Analysis and potential implications

The incident involving Tawasol highlights the risks associated with the double extortion method. In such attacks, threat actors do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information to use as leverage. This method ensures that even if an organization can restore its systems from backups, the threat of a data leak remains a potent weapon for the attackers.

The potential leak of organizational data can lead to several secondary risks. For the organization, a public release of data could negatively impact its commercial reputation and disrupt its operational processes. Furthermore, the organization may face legal obligations under the data protection regulations established in Egypt. For the individuals involved, such as employees and customers, the exposure of data can lead to risks such as identity theft or targeted phishing attacks.

While public information regarding the devman group remains limited, the incident underscores the importance of robust cybersecurity postures. Organizations in the professional services sector can take several defensive steps to mitigate these risks. These include maintaining rigorous data encryption standards, implementing strict access controls, and ensuring comprehensive monitoring of network activity to detect unauthorized data movement. Additionally, having a well-defined incident response plan and regular backups are essential components of a modern defense strategy against ransomware-driven extortion.