Play
InactivePlay also known as
Total victims
74
This month
2
Active
—
DayBreach AI intelligence
How it operates
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs
MITRE ATT&CK profile
G1040
[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)
Techniques it uses
Data Transfer Size Limits
T1016System Network Configuration Discovery
T1048Exfiltration Over Alternative Protocol
T1070.004File Deletion
T1059.003Windows Command Shell
T1059.001PowerShell
T1560.001Archive via Utility
T1018Remote System Discovery
T1057Process Discovery
T1027.010Command Obfuscation
T1587.001Malware
T1078.003Local Accounts
T1021.002SMB/Windows Admin Shares
T1685.005Clear Windows Event Logs
T1078Valid Accounts
T1105Ingress Tool Transfer
Associated malware and tools