Play

Play, also tracked as PlayCrypt and Balloonfly, is a ransomware threat actor and extortion operation active since at least 2022. The group is primarily known for conducting double-extortion intrusions in which data is stolen prior to encryption and victims are pressured through leak-site publication threats. Play has targeted organizations across multiple countries and sectors, including healthcare, manufacturing, telecommunications, logistics, technology, construction, business services, and consumer-facing enterprises. The operation is generally characterized as financially motivated ransomware activity rather than a formally attributed state-sponsored intrusion set. It has been associated with opportunistic and broad targeting of enterprises, with victimology spanning North America, Europe, and other regions. Public reporting has linked the group to use of criminal infrastructure and bulletproof hosting services that also supported other major ransomware ecosystems, including infrastructure provided by Media Land and ML.Cloud. Play commonly conducts enterprise-wide ransomware attacks following network compromise, data theft, and lateral movement. The group is associated with tactics typical of modern ransomware operations, including exploitation of exposed services or vulnerable public-facing applications, credential abuse, privilege escalation, defense evasion, remote administration, persistence, exfiltration, and impact through encryption. The actor has also been reported under aliases including Play ransomware, Play ransomware group, Play ransomware gang, and PLAY_RANSOMWARE. Play is widely recognized in the cyber threat landscape as a distinct ransomware brand responsible for repeated data-theft-and-encryption incidents against private-sector organizations. High-confidence reporting supports its role as an active extortion-focused cybercriminal group with a sustained victim tempo and reliance on resilient third-party criminal infrastructure.