Loading story…
Trend Micro reported that the Play ransomware operation uses an intrusion and extortion playbook that closely resembles activity previously associated with Hive and Nokoyawa, suggesting overlap in tooling, tradecraft, or operator relationships. The group was observed relying on hands-on-keyboard techniques after initial access, moving laterally through victim environments and deploying ransomware in a manner consistent with established big-game hunting operations.
The research indicates that Play’s methods align with a broader ransomware ecosystem in which affiliates or closely linked actors reuse proven attack chains, making attribution and defense more difficult. For defenders, the overlap highlights the need to monitor for shared behaviors across ransomware families rather than relying only on malware names, especially around post-compromise lateral movement, privilege escalation, and data-extortion activity.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Trend Micro published research analyzing the Play ransomware group's attack playbook and reported similarities to the tactics, techniques, and procedures associated with Hive and Nokoyawa, suggesting an affiliation or overlap in operations.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Play ransomware** group, also tracked as **PlayCrypt** and attributed by Symantec to **Balloonfly**, has conducted double-extortion intrusions since 2022 while refining both its initial access and post-compromise tradecraft. Symantec reported the group exploited Microsoft Exchange flaws **`CVE-2022-41080`** and **`CVE-2022-41082`**, then used newly observed custom .NET utilities to accelerate victim profiling and data access before encryption. One tool, **Grixba**, surveys domain users, computers, software, services, security products, backup platforms, and remote administration tools, and can also clear logs on local and remote systems; another uses the **AlphaVSS** library to copy files from **Volume Shadow Copy Service** snapshots, including files normally locked by the operating system. Reverse-engineering of the Play encryptor shows a ransomware family built for enterprise attacks, using a hybrid **RSA-AES** scheme, heavy obfuscation, API hashing, and anti-analysis techniques. The malware has been linked with tools and access methods including **SystemBC RAT**, **Cobalt Strike**, **AdFind**, **WinPEAS**, **WinSCP**, **RDP**, and **SMB**, and it enumerates local and network drives, skips selected files and directories, encrypts files in size-based chunks, appends the **`.PLAY`** extension, and drops a **`ReadMe.txt`** ransom note. Researchers also noted a coding flaw that can cause files to be renamed even when encryption does not complete successfully, underscoring both the malware’s sophistication and its ongoing evolution.
Aug 15, 2026
Reporting and research published in mid-January 2026 highlights continued **high ransomware activity** and rapid evolution in initial-access and evasion tradecraft. A Symantec/Carbon Black Threat Hunter Team study cited by *Help Net Security* reports ransomware actors claimed **4,737 attacks in 2025**, with only brief slowdowns after major disruptions; the abrupt April 2025 shutdown of **RansomHub** was followed by affiliates quickly shifting to other operations, while **LockBit** failed to recover after late-2024 law-enforcement action. The same reporting notes a broader shift toward **extortion models that don’t rely on encryption**, emphasizing data theft and coercion as groups diversify pressure tactics. Multiple technical reports describe how attackers are improving delivery and resilience. *BleepingComputer* says **Gootloader** now uses heavily malformed ZIP files—concatenating **500–1,000** ZIP archives and manipulating ZIP structures (e.g., truncated `EOCD`)—to crash or defeat common analysis tools while still extracting via Windows’ default utility, supporting its role as an initial-access vector often preceding ransomware. *The Register* reports **DeadLock** ransomware uses **Polygon smart contracts** to frequently rotate proxy infrastructure for victim communications (via an HTML wrapper pointing victims to the *Session* messenger), complicating blocking and takedown efforts; Group-IB notes DeadLock also departs from typical double-extortion by lacking a public data-leak site and instead threatening underground data sales. Separately, Microsoft-observed phishing described by *KnowBe4* shows threat actors exploiting **email routing/spoofing misconfigurations** to make phishing appear internal (often leveraging **Tycoon2FA**), while ReliaQuest’s trend report and a separate write-up on **CastleLoader** describe human-driven initial access (spearphishing/drive-by) and social-engineering lures such as **ClickFix** being used to stage loaders and follow-on payloads—underscoring that access-broker and loader ecosystems continue to feed ransomware and broader intrusion activity.
Jun 29, 2026
Hive emerged as a prolific ransomware-as-a-service operation that heavily targeted healthcare and other enterprises, using **double extortion** to steal data and encrypt systems. Reporting tied the group to intrusions involving phishing, vulnerable RDP, stolen VPN credentials, and possible exploitation of Microsoft Exchange `ProxyShell`, followed by lateral movement with RDP and WMI, use of Cobalt Strike, shadow-copy deletion, and exfiltration through tools such as 7-Zip and anonymous file-sharing services. The group expanded beyond Windows with Linux and FreeBSD encryptors, including VMware ESXi-focused variants, and was linked to major disruptions at hospitals and other organizations. At the same time, academics from Kookmin University published a decryption method that exploited weaknesses in Hive’s custom XOR-based file-encryption design, reporting recovery of more than **95%** of the master key and decryption of roughly **82% to 98%** of affected files without the attackers’ private key. Subsequent public research and proof-of-concept tooling documented Hive version-specific decryptors and analysis resources, while the ransomware operators responded by hardening their malware, including rewriting the Linux ESXi encryptor in **Rust** and moving ransom-site credentials out of embedded samples and into runtime command-line arguments to reduce analysis and monitoring opportunities.
Aug 15, 2026