Play
| Active
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.
On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs
On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs
Victims
1239
First Discovered
2022-11-26
victim
Last Discovered
2026-04-06
victim
Inactive Since
11
days
Avg Delay
22.4
days
Infostealer
3.9%
victims with domain
Known Locations (4)
Target (Available)
Top 5 Activity Sectors
- Manufacturing 192
- Business Services 151
- Technology 89
- Construction 57
- Transportation/Logistics 42
Top 5 Countries
-
United States
813
-
Canada
89
-
United Kingdom
38
-
Germany
33
-
Sweden
14
Heatmap (Available)
Ransom Notes (3)
Tools Used (Available)
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
|
AdFind
WKTools
|
|
GMER
IOBit
PowerTool
EDRKill (echo_driver.sys + DBUtil 2.3)
icardagt.exe (version.dll DLL sideload)
|
Mimikatz
HandleKatz
Nanodump
|
Cobalt Strike
WinPEAS
|
FRP
Plink
|
PsExec
|
WinSCP
|
Vulnerabilities Exploited (0)
No vulnerabilities exploited available.
TTPs Matrix (0)
No TTPs available.
Negotiation Chats (0)
No negotiation chats available.
YARA Rules (1)
Indicators of Compromise (IoCs) (0)
No IoCs available for this group.
Victims (1239)
United States : M?????n C?????? & W?? & The ???? G????…
Australia - Nova Group is a leading engineering services and technology solutions partner. Our visio…
information: LIBRA VIRTUA provides the necessary LIBRA modules, the database manager, server capacit…
Saxon, Switzerlandi ; Commune de Saxon is a company that operates in the Government industry.…
Texas, United Statesi - Founded in 1996, Negma Business Solutions, Inc. has been leading the way, pr…
Netherlandsi - Woonkracht10 is a housing corporation in the Drechtsteden region and manages more tha…
