Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · play · Crime · ransomware.live + mitre-attack · refreshed 2026-10-06

play

MITRE G1040 ↗

play — ATT&CK rosePL

attack rose · 26 techniques across 13 tactics

Last 30 days

last seen today
dispatches32
victims16
CVEs seen0
seen against
United States · Canada · Brazil · Germany · Ireland
sectors
Manufacturing · Professional Services · Agriculture and Food Production · Healthcare · Hospitality

What changed

ledger · newest first
  1. —17 d agovictimsvictim count 42 → 43 (+1)
  2. —24 d agovictimsvictim count 38 → 42 (+4)
  3. —1 mo agovictimsvictim count 34 → 38 (+4)

Analyst brief

ransomware.live + mitre-attack

a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. <br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.

NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. com/crocodyli/ThreatActors-TTPs

Observed targets (as stated by the sources)

8 countries · 11 sectors
United StatesCanadaGermanyBrazilIrelandSerbiaLatviaUnited Kingdom

assessed originnot stated by sourcesobserved targets · 8

countries · 8

  • United States
  • Canada
  • Germany
  • Brazil
  • Ireland
  • Serbia
  • Latvia
  • United Kingdom

sectors · 11

  • Manufacturing
  • Professional Services
  • Technology
  • Other
  • Financial Services
  • Agriculture and Food Production
  • Retail & E-Commerce
  • Not Found
  • Healthcare
  • Hospitality
  • Energy & Utilities

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

26 techniques · 13 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    1 technique

  3. Execution

    2 techniques

  4. Persistence

    1 technique

  5. Stealth

    5 techniques

  6. Defense impairment

    2 techniques

  7. Credential access

    1 technique

  8. Discovery

    6 techniques

  9. Lateral movement

    1 technique

  10. Collection

    1 technique

  11. Command and control

    1 technique

  12. Exfiltration

    2 techniques

  13. Impact

    1 technique

select a technique

Arsenal

2 malware · 7 tools
Malware
Malware · 2ATT&CK
Cobalt StrikeS0154 ↗
PlaycryptS1162 ↗
Tools
Tools · 7ATT&CK
NltestS0359 ↗
AdFindS0552 ↗
PsExecS0029 ↗
EmpireS0363 ↗
WevtutilS0645 ↗
BloodHoundS0521 ↗
MimikatzS0002 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Victims

leak-site listings via ransomware.live
Victims observed
33
First observed
Last observed on leak site
Lifetime rate
≈ 8.3 / month
Last 30 days
above the lifetime rate 16

lifetime rate = victims ÷ months from first to last observed · ▲ above that rate is worse · a quiet leak site says nothing about the crew

Take it with you

keyless · no signup

References

4 sources
  1. 1.ransomware.live
  2. 2.attack.mitre.org/groups/G1040
  3. 3.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
  4. 4.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware…

Track play on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.