Loading threat actor…
Play, also known as Playcrypt and Balloonfly, is a financially motivated ransomware and data-extortion operation active since at least June 2022. It targets organizations across multiple industries, including information technology, financial services, manufacturing, professional services, food production, hospitality, and government. Its victims include organizations in the United States, Canada, Germany, Belgium, and Argentina, including Rackspace, H-Hotels, the city of Antwerp, and the Judiciary of Córdoba. Play develops custom ransomware and combines file encryption with data theft and threats of public disclosure. It publishes victim claims through a data-leak site and uses threatened disclosure to pressure organizations into negotiations. Observed initial-access methods include abuse of valid VPN and RDP accounts and exploitation of internet-facing systems, including FortiOS vulnerabilities CVE-2018-13379 and CVE-2020-12812 and Microsoft Exchange vulnerabilities. In the Rackspace intrusion, Play used the OWASSRF exploit involving CVE-2022-41080 to compromise Exchange servers while bypassing ProxyNotShell URL-rewrite mitigations. A documented financial-sector intrusion involved unauthorized installation of AnyDesk, attempts to manipulate Active Directory, FTP-based data exfiltration, and encryption of a storage area network. Play has also been associated with ransomware incidents involving vulnerable ScreenConnect deployments, although exploitation of the ScreenConnect vulnerabilities was not conclusively established.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
45 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
13 malware families attributed to this actor across reporting.
8 additional families tracked in Mallory.
18 CVEs this actor has used in observed campaigns. 18 of them exploited in the wild.
The Common Log File System (CLFS) 0-day vulnerability CVE-2025–29824 was confirmed to have been exploited by attackers associated with PLAY and Storm-2460, and according to Symantec, the vulnerability may have already fallen into the hands of multiple attackers and been exploited before it was patched.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through ... Microsoft Exchange (CVE-2022-41040 and CVE-2022-41082, also known as ProxyNotShell) vulnerabilities.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through ... Microsoft Exchange (CVE-2022-41040 and CVE-2022-41082, also known as ProxyNotShell) vulnerabilities.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through known FortiOS (CVE-2018-13379 and CVE-2020-12812) ... vulnerabilities.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through known FortiOS (CVE-2018-13379 and CVE-2020-12812) ... vulnerabilities.
13 more CVEs tied to this actor tracked in Mallory.
82 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Reportedly conducted a ransomware attack against US-based Pure Options, listed in the report as a financial services organization. The breach and discovery timestamps are both recorded as October 16, 2026, at 20:38 UTC.
Reportedly conducted a ransomware attack against MicroSearch Corporation, a US-based technology organization associated with www.microsearch.net. The report lists both the breach and discovery time as October 16, 2026, at 20:39 UTC.
Reportedly conducted a ransomware attack against New Tec Tool Limited, a Hong Kong-based manufacturing organization. The breach was reported as occurring on October 16, 2026, at 20:39 UTC and discovered at 20:40 UTC. The content provides no technical details or supporting evidence for the attribution.
Reportedly conducted a ransomware attack against WSBI-ESBG, a Belgium-based financial services organization. The incident was reported as breached and discovered on October 16, 2026, at 20:40 UTC. No technical details or supporting attribution evidence are provided.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.