play

Play (PlayCrypt) is a ransomware group active since 2022, known for double extortion.

Analyst brief

The Play (PlayCrypt) ransomware group is a financially motivated threat actor active since 2022, operating a double extortion model. They target a wide range of sectors including Professional Services, Manufacturing, Retail, and Financial Services, primarily in the US, UK, Germany, and other Western nations. Their key TTPs involve initial access via exploiting public-facing applications (T1190), credential access from LSASS memory (T1003.001) using Mimikatz (S0002), lateral movement with PsExec (S0029), maintaining C2 with Cobalt Strike (S0154), and impairing defenses by clearing Windows Event Logs (T1685.005). Defenders should prioritize patching internet-exposed services, detecting LSASS access attempts, and monitoring for lateral movement and data exfiltration indicators.

play

activecrime

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs

observed victims (by country)

United StatesUnited KingdomGermanyItaly

observed sectors

Professional ServicesRetail & E-CommerceManufacturingFinancial Services

38 victims · last active 17 Aug 2026

techniques · ATT&CK

Malware Exploit Public-Facing Application Windows Command Shell External Remote Services Command Obfuscation File Deletion LSASS Memory System Network Configuration Discovery+8

malware

Cobalt Strike Playcrypt Nltest AdFind PsExec Empire+3

recent activity · our intel

play → Bridgeport Capital Services17 Aug 2026 Ransomware: play → Bridgeport Capital Services17 Aug 2026 play → Sam Pack Auto Group17 Aug 2026

source: ransomware.live + mitre-attackG1040 4 refs →

Kill-chain playbook13

01
Resource Development
T1587.001
Monitor suspicious file downloads and network activity to detect malware development.
02
Initial Access
T1190
Use Web Application Firewall (WAF) and penetration testing tools to detect exploit attempts on public-facing applications.
03
Execution
T1059.003
Monitor process creation and command line logging to detect suspicious Windows Command Shell activity.
04
Persistence
T1133
Restrict access to External Remote Services and monitor VPN and RDP logs to detect suspicious connections.
05
Defense Evasion
Monitor command line and file system logging to detect suspicious command obfuscation and file deletion activity.
06
Credential Access
T1003.001
Monitor access to the LSASS process to detect attempts to obtain credentials from LSASS memory.
07
Discovery
T1016 T1018
Monitor network traffic and process creation logging to detect System Network Configuration Discovery and Remote System Discovery.
08
Lateral Movement
T1021.002
Monitor SMB traffic and access to shared folders to detect lateral movement via SMB/Windows Admin Shares.
09
Collection
T1560.001
Monitor the use of archive utility programs to detect attempts to archive data via utility.
10
Command and Control
T1105
Monitor network traffic and file downloads to detect Ingress Tool Transfer.
11
Exfiltration
T1030 T1048
Monitor network traffic and data transfer size to detect suspicious data exfiltration.
12
Impact
T1657
Monitor unusual financial transactions and internal controls to detect Financial Theft.
13
Defense Impairment
T1685.005
Monitor Windows Event Logs to detect attempts to Clear Windows Event Logs.

FAQ2

What methods does the Play ransomware group use for initial access?

The Play ransomware group primarily exploits public-facing applications for initial access (T1190).

What technique does Play ransomware use to hide its activity?

Play ransomware clears Windows Event Logs to hide its activity (T1685.005).

play

Analyst brief

play

Kill-chain playbook13

Resource Development

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defense Impairment

FAQ2

See also4

play

Analyst brief

play

Kill-chain playbook13

Resource Development

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Defense Impairment

FAQ2

See also4