Loading malware…
Play, also known as PlayCrypt, is a ransomware family associated with a financially motivated operation active since at least June 2022. It targets Windows systems and has Linux variants targeting VMware ESXi infrastructure. The operation uses double extortion, stealing sensitive information before encrypting systems and threatening public disclosure to pressure victims into paying. Victims span multiple sectors, including healthcare, critical infrastructure, manufacturing, education, finance, and technology, across North America, South America, and Europe. Play primarily operates as a closed or tightly controlled group rather than a conventional open ransomware-as-a-service program.
Play intrusions have used compromised VPN and RDP accounts and exploitation of internet-facing systems. Observed access methods include exploitation of Fortinet vulnerabilities and Microsoft Exchange vulnerabilities, including OWASSRF exploitation involving CVE-2022-41080 that bypassed ProxyNotShell URL rewrite mitigations. Following compromise, operators enumerate network shares and virtualization infrastructure, obtain credentials with Mimikatz, and use administrative tools such as PsExec and WMI for lateral movement and payload deployment. SystemBC has also been used for command and control and continued access.
Operators manually select valuable documents, stage stolen information with WinRAR, and exfiltrate it using WinSCP or FTP. Before deploying ransomware across multiple hosts, they have disabled endpoint protection and Windows firewall controls, configured antivirus exclusions, deleted shadow copies, and cleared security logs. Observed attacks include removal of SentinelOne through a legitimate vendor cleanup utility. Encryption disrupts servers, workstations, and shared storage, while ransom notes direct victims to contact the attackers for negotiations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
12 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
“Path Traversal: This secondary vulnerability provides attackers with a method to access unauthorized files, further compromising the integrity of the system. (CVE-2024-1708)”
Microsoft says Cuba ransomware threat actors are hacking Microsoft Exchange servers unpatched against a critical server-side request forgery vulnerability also exploited in Play ransomware attacks. Rackspace confirmed that Play ransomware used an exploit dubbed OWASSRF targeting CVE-2022-41080 after bypassing ProxyNotShell URL rewrite mitigations.
“Authentication Bypass ... allows nefarious actors to generate their own administrative user on the platform, granting them complete control over the platform. (CVE-2024-1709)”
Another infection vector used by the group is the exploitation of public-facing applications, particularly through ... Microsoft Exchange (CVE-2022-41040 and CVE-2022-41082, also known as ProxyNotShell) vulnerabilities. | The Play ransomware group (also known as Playcrypt) has been active since at least June 2022.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through ... Microsoft Exchange (CVE-2022-41040 and CVE-2022-41082, also known as ProxyNotShell) vulnerabilities. | The Play ransomware group (also known as Playcrypt) has been active since at least June 2022.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through known FortiOS (CVE-2018-13379 and CVE-2020-12812) ... vulnerabilities. | The Play ransomware group (also known as Playcrypt) has been active since at least June 2022.
Another infection vector used by the group is the exploitation of public-facing applications, particularly through known FortiOS (CVE-2018-13379 and CVE-2020-12812) ... vulnerabilities. | The Play ransomware group (also known as Playcrypt) has been active since at least June 2022.
In November 2023, the Cybersecurity & Infrastructure Security Agency (CISA) published guidance for addressing vulnerability CVE-2023-4966, affecting Citrix NetScaler ADC and NetScaler Gateway. This vulnerability is also known as Citrix Bleed.
CVE-2025–29824: An unpatched Windows CLFS vulnerability exploited by Play ransomware, which is sometimes associated with broader ransomware ecosystem activities. While not directly attributed to Qilin, it highlights a pattern of exploiting critical OS vulnerabilities. | CVE-2025–29824: An unpatched Windows CLFS vulnerability exploited by Play ransomware, which is sometimes associated with broader ransomware ecosystem activities.
The American Hospital Association is warning hospitals and other healthcare sector organizations of rising double-extortion attack threats involving the Play ransomware group. | multiple ransomware groups, including initial access brokers with ties to Play ransomware operators, are also exploiting three vulnerabilities - CVE-2024-57727 - in remote monitoring and management tool SimpleHelp to conduct remote code execution at many U.S.-based entities
Play (AKA PlayCrypt) ransomware is a private ransomware operation that has been active since, at least, June 2022. The group operates in a double extortion method, where the victim data is stolen and leaked via a data leak site if the ransom demand is not paid.
The following analytic identifies remote code execution (RCE) attempts targeting F5 BIG-IP, BIG-IQ, and Traffix SDC devices, specifically exploiting CVE-2020-5902.
11 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Play Ransomware Strikes The Innovation Group.” The report states that on October 13, 2026, the Play ransomware group claimed responsibility for a cyberattack against The Innovation Group and threatened to publish sensitive data unless negotiations began.
Early examples include North Korean APTs “Andariel” and “Moonstone Sleet” deploying “Play” ransomware and “Qilin,” respectively.
ShadowSyndicate "had been associated with the ALPHV/BlackCat, Cl0p, Royal, Play, Cactus, Nokoyawa, and Quantum ransomware operations."
Two separate PlayCrypt intrusions used RDP with compromised administrator credentials, WinRAR staging using '-ep1 -scul -r0', WinSCP exfiltration, and—in the second intrusion—ransomware deployment from C:\Users\Public\Music\ across 15+ hosts.
Two separate PlayCrypt intrusions used RDP with compromised administrator credentials, WinRAR staging using '-ep1 -scul -r0', WinSCP exfiltration, and—in the second intrusion—ransomware deployment from C:\Users\Public\Music\ across 15+ hosts.
These RaaS programs include: Akira (Howling Scorpius) ALPHV (Ambitious Scorpius) DragonForce (Slippery Scorpius) Play (Fiddling Scorpius) Qilin (Spikey Scorpius) RansomHub (Spoiled Scorpius)
16 distinct techniques documented for this family, organized by ATT&CK tactic.
The initial point of entry appeared to be VPN access using legitimate credentials
Play favors attacking managed service providers and using compromised security vendor access as an entry point.
The initial point of entry appeared to be VPN access using legitimate credentials
There are a few other features such as DLL injection and networking that will not be covered in this analysis.
The initial point of entry appeared to be VPN access using legitimate credentials
The report also describes payload hiding and execution techniques that make the disruption harder to catch. Sodinokibi encrypts embedded code until runtime, Magniber can run code inside another process, and Play uses legitimate-looking names and locations.
There are a few other features such as DLL injection and networking that will not be covered in this analysis.
The initial point of entry appeared to be VPN access using legitimate credentials
Everest disables Windows shadow copies and Controlled Folder Access and removes the open-source anti-ransomware tool Raccine. Play deploys EDR-killer drivers ahead of Active Directory reconnaissance and credential-access activity.
Everest uses ProcDump for credential dumping. Play's tooling includes credential-access techniques like HandleKatz and Nanodump used for stealthy LSASS memory access.
Known IOCs associated with Everest include SoftPerfect Network Scanner and ProcDump for credential dumping and reconnaissance. Play uses AdFind, a command-line Active Directory query tool used for network discovery.
On some machines malware was deployed and triggered manually via RDP, on others it was via PSExec.
On some machines malware was deployed and triggered manually via RDP
on others it was via PSExec
However, they are stealing data from their victims' networks before deploying ransomware payloads and will threaten to leak it online if the ransom is not paid.
several hundred gigabytes of data were published on the PLAY data leak site
Onsite backups were either encrypted or destroyed.
Hurley ... has fallen victim to a ransomware attack conducted by the group play.
56 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
139 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Ransomware associated with the Play group, which claimed an attack against a U.S. technology company and threatened a data leak. The report does not establish that the Play ransomware payload was deployed or that files were encrypted, and provides no technical details or independent verification of the claim.
Ransomware mentioned as background context for prior attacks involving SimpleHelp. No ransomware-specific behavior or distribution details are provided.
Ransomware family mentioned only in a headline alleging exposure of stolen Super Quik data.
RaaS ransomware that uses intermittent encryption, targets managed service providers and security-vendor access, and includes a Linux variant targeting VMware ESXi.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.