Play

Sobre el grupo

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

Arsenal y tácticas

Lo que el grupo usa y cómo ataca, según el perfil que ransomware.live mantiene a partir de informes públicos. Las CVE de ese perfil están en la sección de CVE, con la fuente al lado.

Herramientas

Cómo ataca el grupo

El detalle de cada técnica es el texto de la fuente, en inglés.

• Initial Access TA0001
  • T1078 Valid Accounts: Compromised VPN credentials used to authenticate directly to victim networks.
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1190 Exploit Public-Facing Application: Play exploits vulnerabilities in Microsoft Exchange (ProxyNotShell CVE-2022-41040/CVE-2022-41082), FortiOS SSL VPN (CVE-2018-13379), and RDP to gain initial access.
• Execution TA0002
  • T1053.005 Scheduled Task/Job: Scheduled Task: Scheduled tasks used for payload persistence and execution across compromised hosts.
  • T1059 Command and Scripting Interpreter
  • T1059.001 Command and Scripting Interpreter: PowerShell: PowerShell scripts used for payload execution and post-exploitation tooling deployment.
  • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [Play](https://attack.mitre.org/groups/G1040) has used a batch script to remove indicators of its presence on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Persistence TA0003
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Privilege Escalation TA0004
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Stealth TA0005
  • T1027 Obfuscated Files or Information: Play ransomware payloads are split into multiple parts to bypass AV scanning; parts reassembled on target systems.
  • T1027.010 Obfuscated Files or Information: Command Obfuscation: [Play](https://attack.mitre.org/groups/G1040) has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1070 Indicator Removal
  • T1070.004 Indicator Removal: File Deletion: [Play](https://attack.mitre.org/groups/G1040) has used tools including [Wevtutil](https://attack.mitre.org/software/S0645) to remove malicious files from compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Credential Access TA0006
  • T1003 OS Credential Dumping
  • T1003.001 OS Credential Dumping: LSASS Memory: Mimikatz and similar tools used for LSASS memory dumping to harvest credentials.
  • T1003.003 OS Credential Dumping: NTDS: NTDS.dit extracted from domain controllers to obtain all domain account hashes.
  • T1552 Unsecured Credentials
• Discovery TA0007
  • T1016 System Network Configuration Discovery
  • T1018 Remote System Discovery: [Play](https://attack.mitre.org/groups/G1040) has used tools such as [AdFind](https://attack.mitre.org/software/S0552), [Nltest](https://attack.mitre.org/software/S0359), and [BloodHound](https://attack.mitre.org/software/S0521) to enumerate shares and hostnames on compromised networks.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1046 Network Service Discovery: Network scanning tools used to enumerate hosts, services, and potential lateral movement targets.
  • T1057 Process Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1082 System Information Discovery: [Play](https://attack.mitre.org/groups/G1040) has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1083 File and Directory Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1087.002 Account Discovery: Domain Account: Active Directory enumeration to identify privileged accounts and high-value targets.
  • T1518 Software Discovery
  • T1518.001 Software Discovery: Security Software Discovery
• Lateral Movement TA0008
  • T1021.001 Remote Services: Remote Desktop Protocol: RDP used for lateral movement across victim networks.
  • T1021.002 Remote Services: SMB/Windows Admin Shares: PsExec and SMB used to propagate payloads laterally.
  • T1570 Lateral Tool Transfer
• Collection TA0009
  • T1560 Archive Collected Data
  • T1560.001 Archive Collected Data: Archive via Utility: WinRAR used to compress and archive stolen data prior to exfiltration.
• Exfiltration TA0010
  • T1030 Data Transfer Size Limits: [Play](https://attack.mitre.org/groups/G1040) has split victims' files into chunks for exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1048 Exfiltration Over Alternative Protocol: WinSCP and Rclone used to exfiltrate data to actor-controlled infrastructure and cloud storage ahead of encryption.
• Command and Control TA0011
  • T1105 Ingress Tool Transfer: [Play](https://attack.mitre.org/groups/G1040) has used [Cobalt Strike](https://attack.mitre.org/software/S0154) to download files to compromised machines.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1219 Remote Access Software: Cobalt Strike, SystemBC, and AnyDesk used as C2 frameworks for persistent access.
• Impact TA0040
  • T1486 Data Encrypted for Impact: Play ransomware uses AES-RSA hybrid encryption. Files appended with .play extension. Targets Windows and Linux/ESXi environments. Double extortion model with data published on Play leak site. Notable for NOT including ransom note in individual encrypted files — single note left at root of C: drive.
  • T1489 Service Stop: Database, mail, backup, and security services terminated before encryption to ensure maximum file access.
  • T1490 Inhibit System Recovery: Shadow copies deleted and Windows recovery disabled to prevent victim restoration of files.
  • T1657 Financial Theft
• Resource Development TA0042
  • T1587.001 Develop Capabilities: Malware: [Play](https://attack.mitre.org/groups/G1040) developed and employ [Playcrypt](https://attack.mitre.org/software/S1162) ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware Advisory December 2023)
  • T1588.002 Obtain Capabilities: Tool: [Play](https://attack.mitre.org/groups/G1040) has used multiple tools for discovery and defense evasion purposes on compromised hosts.(Citation: CISA Play Ransomware Advisory December 2023)
• Defense Impairment TA0112
  • T1484 Domain or Tenant Policy Modification
  • T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
  • T1685 Disable or Modify Tools: Security tools including Windows Defender and AV products disabled prior to encryption. [Play](https://attack.mitre.org/groups/G1040) has used tools including GMER, IOBit, and PowerTool to disable antivirus software.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1685.005 Disable or Modify Tools: Clear Windows Event Logs: Windows event logs wiped to remove forensic evidence using wevtutil. [Play](https://attack.mitre.org/groups/G1040) has used tools to remove log files on targeted systems.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Fuente: ransomware.live, perfil del grupo · actualizado el 12 nov 2026 · actividad de 26 nov 2022 a 11 nov 2026

Sitios del grupo

4 sitio(s) conocido(s): 0 en línea, 4 fuera de línea, 0 incautado(s).

Fuente: ransomware.live · verificado el 12 nov 2026

Notas de rescate 3

El texto que el grupo deja en las máquinas atacadas, del acervo de ransomware.live.

PLAY
[correo]

PLAY
news portal, tor network links:
[dirección .onion]
[dirección .onion]
[correo]

Your network has been encrypted. Your private, personal, corporate, confidential data has been stolen.
If you do not resolve the issue, your data will be published on our leak portal.
News portal, tor network links: 
[dirección .onion]
[dirección .onion]
contact email: [correo]
PLAY Ransomware Team

Fuente: ransomware.live · actualizado el 12 nov 2026

Detección 4

El paquete que el equipo de seguridad usa para buscar al grupo en su propio entorno: los indicadores (IOC) y las reglas YARA, de ransomware.live.

3 indicador(es) quedan solo en el paquete completo: los contactos de los criminales (correo, Tox, Session, Telegram, PGP), las direcciones .onion, los servidores FTP y las billeteras.

Contenido de defensa: úsalo solo en entornos que tienes autorización para analizar. Fuente: ransomware.live · actualizado el 13 nov 2026