Play

Análise Vexday

Play é um grupo de ransomware ativo desde pelo menos 2022, responsável pela implantação do ransomware Playcrypt contra organizações dos setores empresarial, governamental, de infraestrutura crítica, saúde e mídia na América do Norte, América do Sul e Europa. O grupo adota o modelo de dupla extorsão, exfiltrando dados antes de criptografar os sistemas das vítimas, e é classificado por pesquisadores de segurança como uma operação fechada. Catalogado no MITRE ATT&CK sob o identificador G1040, o Play possui 26 técnicas documentadas e 6 CVEs atribuídas à sua atuação.

Arsenal e táticas

O que o grupo usa e como ataca, pelo perfil que o ransomware.live mantém a partir de relatórios públicos. As CVEs desse perfil estão na seção de CVEs, com a fonte ao lado.

Ferramentas

Como o grupo ataca

O detalhe de cada técnica é o texto da fonte, em inglês.

• Initial Access TA0001
  • T1078 Valid Accounts: Compromised VPN credentials used to authenticate directly to victim networks.
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1190 Exploit Public-Facing Application: Play exploits vulnerabilities in Microsoft Exchange (ProxyNotShell CVE-2022-41040/CVE-2022-41082), FortiOS SSL VPN (CVE-2018-13379), and RDP to gain initial access.
• Execution TA0002
  • T1053.005 Scheduled Task/Job: Scheduled Task: Scheduled tasks used for payload persistence and execution across compromised hosts.
  • T1059 Command and Scripting Interpreter
  • T1059.001 Command and Scripting Interpreter: PowerShell: PowerShell scripts used for payload execution and post-exploitation tooling deployment.
  • T1059.003 Command and Scripting Interpreter: Windows Command Shell: [Play](https://attack.mitre.org/groups/G1040) has used a batch script to remove indicators of its presence on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Persistence TA0003
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1133 External Remote Services: [Play](https://attack.mitre.org/groups/G1040) has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Privilege Escalation TA0004
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Stealth TA0005
  • T1027 Obfuscated Files or Information: Play ransomware payloads are split into multiple parts to bypass AV scanning; parts reassembled on target systems.
  • T1027.010 Obfuscated Files or Information: Command Obfuscation: [Play](https://attack.mitre.org/groups/G1040) has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1070 Indicator Removal
  • T1070.004 Indicator Removal: File Deletion: [Play](https://attack.mitre.org/groups/G1040) has used tools including [Wevtutil](https://attack.mitre.org/software/S0645) to remove malicious files from compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.002 Valid Accounts: Domain Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1078.003 Valid Accounts: Local Accounts: [Play](https://attack.mitre.org/groups/G1040) has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
• Credential Access TA0006
  • T1003 OS Credential Dumping
  • T1003.001 OS Credential Dumping: LSASS Memory: Mimikatz and similar tools used for LSASS memory dumping to harvest credentials.
  • T1003.003 OS Credential Dumping: NTDS: NTDS.dit extracted from domain controllers to obtain all domain account hashes.
  • T1552 Unsecured Credentials
• Discovery TA0007
  • T1016 System Network Configuration Discovery
  • T1018 Remote System Discovery: [Play](https://attack.mitre.org/groups/G1040) has used tools such as [AdFind](https://attack.mitre.org/software/S0552), [Nltest](https://attack.mitre.org/software/S0359), and [BloodHound](https://attack.mitre.org/software/S0521) to enumerate shares and hostnames on compromised networks.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1046 Network Service Discovery: Network scanning tools used to enumerate hosts, services, and potential lateral movement targets.
  • T1057 Process Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1082 System Information Discovery: [Play](https://attack.mitre.org/groups/G1040) has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1083 File and Directory Discovery: [Play](https://attack.mitre.org/groups/G1040) has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1087.002 Account Discovery: Domain Account: Active Directory enumeration to identify privileged accounts and high-value targets.
  • T1518 Software Discovery
  • T1518.001 Software Discovery: Security Software Discovery
• Lateral Movement TA0008
  • T1021.001 Remote Services: Remote Desktop Protocol: RDP used for lateral movement across victim networks.
  • T1021.002 Remote Services: SMB/Windows Admin Shares: PsExec and SMB used to propagate payloads laterally.
  • T1570 Lateral Tool Transfer
• Collection TA0009
  • T1560 Archive Collected Data
  • T1560.001 Archive Collected Data: Archive via Utility: WinRAR used to compress and archive stolen data prior to exfiltration.
• Exfiltration TA0010
  • T1030 Data Transfer Size Limits: [Play](https://attack.mitre.org/groups/G1040) has split victims' files into chunks for exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1048 Exfiltration Over Alternative Protocol: WinSCP and Rclone used to exfiltrate data to actor-controlled infrastructure and cloud storage ahead of encryption.
• Command and Control TA0011
  • T1105 Ingress Tool Transfer: [Play](https://attack.mitre.org/groups/G1040) has used [Cobalt Strike](https://attack.mitre.org/software/S0154) to download files to compromised machines.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1219 Remote Access Software: Cobalt Strike, SystemBC, and AnyDesk used as C2 frameworks for persistent access.
• Impact TA0040
  • T1486 Data Encrypted for Impact: Play ransomware uses AES-RSA hybrid encryption. Files appended with .play extension. Targets Windows and Linux/ESXi environments. Double extortion model with data published on Play leak site. Notable for NOT including ransom note in individual encrypted files — single note left at root of C: drive.
  • T1489 Service Stop: Database, mail, backup, and security services terminated before encryption to ensure maximum file access.
  • T1490 Inhibit System Recovery: Shadow copies deleted and Windows recovery disabled to prevent victim restoration of files.
  • T1657 Financial Theft
• Resource Development TA0042
  • T1587.001 Develop Capabilities: Malware: [Play](https://attack.mitre.org/groups/G1040) developed and employ [Playcrypt](https://attack.mitre.org/software/S1162) ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware Advisory December 2023)
  • T1588.002 Obtain Capabilities: Tool: [Play](https://attack.mitre.org/groups/G1040) has used multiple tools for discovery and defense evasion purposes on compromised hosts.(Citation: CISA Play Ransomware Advisory December 2023)
• Defense Impairment TA0112
  • T1484 Domain or Tenant Policy Modification
  • T1484.001 Domain or Tenant Policy Modification: Group Policy Modification
  • T1685 Disable or Modify Tools: Security tools including Windows Defender and AV products disabled prior to encryption. [Play](https://attack.mitre.org/groups/G1040) has used tools including GMER, IOBit, and PowerTool to disable antivirus software.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
  • T1685.005 Disable or Modify Tools: Clear Windows Event Logs: Windows event logs wiped to remove forensic evidence using wevtutil. [Play](https://attack.mitre.org/groups/G1040) has used tools to remove log files on targeted systems.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Fonte: ransomware.live, perfil do grupo · atualizado em 12 nov 2026 · atividade de 26 nov 2022 a 11 nov 2026

Sites do grupo

4 site(s) conhecido(s): 0 no ar, 4 fora do ar, 0 apreendido(s).

Fonte: ransomware.live · conferido em 12 nov 2026

Notas de resgate 3

O texto que o grupo deixa nas máquinas atacadas, do acervo do ransomware.live.

PLAY
[e-mail]

PLAY
news portal, tor network links:
[endereço .onion]
[endereço .onion]
[e-mail]

Your network has been encrypted. Your private, personal, corporate, confidential data has been stolen.
If you do not resolve the issue, your data will be published on our leak portal.
News portal, tor network links: 
[endereço .onion]
[endereço .onion]
contact email: [e-mail]
PLAY Ransomware Team

Fonte: ransomware.live · atualizado em 12 nov 2026

Detecção 4

O pacote que o time de segurança usa para procurar o grupo no próprio ambiente: os indicadores (IOCs) e as regras YARA, do ransomware.live.

3 indicador(es) ficam só no pacote completo: os contatos dos criminosos (e-mail, Tox, Session, Telegram, PGP), os endereços .onion, os servidores FTP e as carteiras.

Conteúdo de defesa: use só em ambientes que você tem autorização para analisar. Fonte: ransomware.live · atualizado em 13 nov 2026