Play

About the group

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

Arsenal and tactics

What the group uses and how it attacks, from the profile ransomware.live keeps based on public reporting. The CVEs in that profile are in the CVEs section, with the source next to them.

Tools

How the group attacks

• Initial Access TA0001
  • T1078 Valid Accounts: Compromised VPN credentials used to authenticate directly to victim networks.
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1190 Exploit Public-Facing Application: Play exploits vulnerabilities in Microsoft Exchange (ProxyNotShell CVE-2022-41040/CVE-2022-41082), FortiOS SSL VPN (CVE-2018-13379), and RDP to gain initial access.
• Execution TA0002
  • T1053.005 Scheduled Task/Job: Scheduled Task: Scheduled tasks used for payload persistence and execution across compromised hosts.
  • T1059 Command and Scripting Interpreter
  • T1059.001 Command and Scripting Interpreter: PowerShell: PowerShell scripts used for payload execution and post-exploitation tooling deployment.
  • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [Play](https://attack.mitre.org/groups/G1040) has used a batch script to remove indicators of its presence on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Persistence TA0003
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Privilege Escalation TA0004
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Stealth TA0005
  • T1027 Obfuscated Files or Information: Play ransomware payloads are split into multiple parts to bypass AV scanning; parts reassembled on target systems.
  • T1027.010 Obfuscated Files or Information: Command Obfuscation: [Play](https://attack.mitre.org/groups/G1040) has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1070 Indicator Removal
  • T1070.004 Indicator Removal: File Deletion: [Play](https://attack.mitre.org/groups/G1040) has used tools including [Wevtutil](https://attack.mitre.org/software/S0645) to remove malicious files from compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Credential Access TA0006
  • T1003 OS Credential Dumping
  • T1003.001 OS Credential Dumping: LSASS Memory: Mimikatz and similar tools used for LSASS memory dumping to harvest credentials.
  • T1003.003 OS Credential Dumping: NTDS: NTDS.dit extracted from domain controllers to obtain all domain account hashes.
  • T1552 Unsecured Credentials
• Discovery TA0007
  • T1016 System Network Configuration Discovery
  • T1018 Remote System Discovery: [Play](https://attack.mitre.org/groups/G1040) has used tools such as [AdFind](https://attack.mitre.org/software/S0552), [Nltest](https://attack.mitre.org/software/S0359), and [BloodHound](https://attack.mitre.org/software/S0521) to enumerate shares and hostnames on compromised networks.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1046 Network Service Discovery: Network scanning tools used to enumerate hosts, services, and potential lateral movement targets.
  • T1057 Process Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1082 System Information Discovery: [Play](https://attack.mitre.org/groups/G1040) has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1083 File and Directory Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1087.002 Account Discovery: Domain Account: Active Directory enumeration to identify privileged accounts and high-value targets.
  • T1518 Software Discovery
  • T1518.001 Software Discovery: Security Software Discovery
• Lateral Movement TA0008
  • T1021.001 Remote Services: Remote Desktop Protocol: RDP used for lateral movement across victim networks.
  • T1021.002 Remote Services: SMB/Windows Admin Shares: PsExec and SMB used to propagate payloads laterally.
  • T1570 Lateral Tool Transfer
• Collection TA0009
  • T1560 Archive Collected Data
  • T1560.001 Archive Collected Data: Archive via Utility: WinRAR used to compress and archive stolen data prior to exfiltration.
• Exfiltration TA0010
  • T1030 Data Transfer Size Limits: [Play](https://attack.mitre.org/groups/G1040) has split victims' files into chunks for exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1048 Exfiltration Over Alternative Protocol: WinSCP and Rclone used to exfiltrate data to actor-controlled infrastructure and cloud storage ahead of encryption.
• Command and Control TA0011
  • T1105 Ingress Tool Transfer: [Play](https://attack.mitre.org/groups/G1040) has used [Cobalt Strike](https://attack.mitre.org/software/S0154) to download files to compromised machines.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1219 Remote Access Software: Cobalt Strike, SystemBC, and AnyDesk used as C2 frameworks for persistent access.
• Impact TA0040
  • T1486 Data Encrypted for Impact: Play ransomware uses AES-RSA hybrid encryption. Files appended with .play extension. Targets Windows and Linux/ESXi environments. Double extortion model with data published on Play leak site. Notable for NOT including ransom note in individual encrypted files — single note left at root of C: drive.
  • T1489 Service Stop: Database, mail, backup, and security services terminated before encryption to ensure maximum file access.
  • T1490 Inhibit System Recovery: Shadow copies deleted and Windows recovery disabled to prevent victim restoration of files.
  • T1657 Financial Theft
• Resource Development TA0042
  • T1587.001 Develop Capabilities: Malware: [Play](https://attack.mitre.org/groups/G1040) developed and employ [Playcrypt](https://attack.mitre.org/software/S1162) ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware Advisory December 2023)
  • T1588.002 Obtain Capabilities: Tool: [Play](https://attack.mitre.org/groups/G1040) has used multiple tools for discovery and defense evasion purposes on compromised hosts.(Citation: CISA Play Ransomware Advisory December 2023)
• Defense Impairment TA0112
  • T1484 Domain or Tenant Policy Modification
  • T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
  • T1685 Disable or Modify Tools: Security tools including Windows Defender and AV products disabled prior to encryption. [Play](https://attack.mitre.org/groups/G1040) has used tools including GMER, IOBit, and PowerTool to disable antivirus software.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1685.005 Disable or Modify Tools: Clear Windows Event Logs: Windows event logs wiped to remove forensic evidence using wevtutil. [Play](https://attack.mitre.org/groups/G1040) has used tools to remove log files on targeted systems.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Source: ransomware.live, group profile · updated on 12 Nov 2026 · active from 26 Nov 2022 to 11 Nov 2026

The group's sites

4 known site(s): 0 online, 4 offline, 0 seized.

Source: ransomware.live · checked on 12 Nov 2026

Ransom notes 3

The text the group leaves on attacked machines, from the ransomware.live collection.

PLAY
[email]

PLAY
news portal, tor network links:
[.onion address]
[.onion address]
[email]

Your network has been encrypted. Your private, personal, corporate, confidential data has been stolen.
If you do not resolve the issue, your data will be published on our leak portal.
News portal, tor network links: 
[.onion address]
[.onion address]
contact email: [email]
PLAY Ransomware Team

Source: ransomware.live · updated on 12 Nov 2026

Detection 4

The package a security team uses to hunt for the group in its own environment: the indicators (IOCs) and the YARA rules, from ransomware.live.

3 indicator(s) are only in the full package: the criminals' contacts (email, Tox, Session, Telegram, PGP), .onion addresses, FTP servers and wallets.

Defensive content: use it only in environments you are authorized to analyze. Source: ransomware.live · updated on 13 Nov 2026