GOLD MANUSCRIPT

GOLD MANUSCRIPT is a cybercriminal threat group that has operated the Devman name-and-shame ransomware scheme since April 2025. Whilst initially emerging as an affiliate of other groups including GOLD FEATHER (Qilin), GOLD HUBBARD (RansomHub) and GOLD FLAME (DragonForce), since September 2025 GOLD MANUSCRIPT have operated their own ransomware-as-a-service (RaaS) operation. GOLD MANUSCRIPT are known to have used both data exfiltration and encryption in their attacks, appending encrypted files with the '.devman', '.devman1', or '.devman21' extension.
Unlike many traditional Russian ransomware groups, GOLD MANUSCRIPT maintain an online presence on social media and communicate regularly through the Devman X account. This account is used to engage with security researchers, exert pressure on victims of their attacks and advertise their ransomware affiliate operation.

Although CTU researchers maintain that financially motivated ransomware activity is almost exclusively opportunistic and based on available access, an analysis of leak site data does suggest that GOLD MANUSCRIPT has targeted organizations in the healthcare sector with increasing frequency throughout November and December 2025. This targeting aligns with messaging on the Devman X account describing how they target hospitals due to a perception that they are more likely to pay the ransom.

Third-party reporting suggests that GOLD MANUSCRIPT most frequently achieves initial access via the use of valid credentials, particularly against exposed RDP and VPN services, likely obtained through credential stuffing, password spraying or other credential-based compromise. Following initial access, GOLD MANUSCRIPT deploys a ransomware payload and associated components to enable execution and persistence, commonly through modification of Windows Registry run keys and other boot or logon autostart mechanisms; some reporting also indicates potential use of pre-boot persistence techniques, though this remains limited in visibility. Privilege escalation activity has been observed through access token manipulation, including Parent PID spoofing, enabling elevated execution of malicious processes. Lateral movement within victim environments is assessed to occur primarily via SMB network shares and, in some cases, through the abuse of Group Policy Objects to distribute the ransomware across Active Directory domains. GOLD MANUSCRIPT employs multiple defence evasion techniques, including the use of mutexes to prevent duplicate execution, interaction with the Windows Restart Manager to unlock files for encryption, and the deletion of Volume Shadow Copies to inhibit system recovery.