Loading story…
Check Point Research identified an exploit developer known as PlayBit (also tracked as luxor2008) as the likely author of multiple Windows local privilege escalation 1-day exploits, linking the actor to code for CVE-2013-3660, CVE-2015-0057, CVE-2015-1701, CVE-2016-7255, and CVE-2018-8453. The attribution was based on recurring coding patterns across samples, including hash-based API imports, detailed OS and patch-state checks, kernel pointer leaks through Desktop Heap metadata, and evolving SMEP/NX bypass methods. Researchers said the exploits were marketed commercially, with broad Windows-version support and pricing reportedly in the $5,000 to $10,000 range.
The same exploit lineage was later tied to real-world attacks by both crimeware and targeted operators. The referenced vulnerabilities were used by malware families including Dyre, Ramnit, Locky, LockCrypt, Maze, REvil, and Sodin, while CVE-2018-8453 was also reported in targeted attacks. The reporting indicates that PlayBit’s tooling and exploit-development tradecraft became a shared enabler for post-compromise privilege escalation, helping ransomware and other malware operators turn initial access into full system control.
Get the actors, campaigns, and ATT&CK mapping behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Check Point Research published an analysis attributing five Windows 1-day local privilege escalation exploits—CVE-2013-3660, CVE-2015-0057, CVE-2015-1701, CVE-2016-7255, and CVE-2018-8453—to exploit developer PlayBit, also known as luxor2008. The report also linked PlayBit's tooling and commercialization activity to broader crimeware use.
Securelist reported that Sodin ransomware exploited the Windows local privilege escalation vulnerability CVE-2018-8453. Check Point identified the exploit sample used by REvil/Sodinokibi as the starting point for its PlayBit investigation.
A Full Disclosure post discussed exploitation ideas for CVE-2013-3660 under memory pressure, providing public technical detail around the Windows local privilege escalation flaw later linked to PlayBit's 1-day exploit work.
Securelist reported that CVE-2018-8453 was used in targeted attacks as a zero-day. Check Point later noted those earlier zero-day attacks were attributed to FruityArmor.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
4 references tracked. Mallory keeps watching after this page renders.
research.checkpoint.com
Open sourcesecurelist.com
Open sourceseclists.org
Open sourcesecurelist.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Play ransomware** group, also tracked as **PlayCrypt** and attributed by Symantec to **Balloonfly**, has conducted double-extortion intrusions since 2022 while refining both its initial access and post-compromise tradecraft. Symantec reported the group exploited Microsoft Exchange flaws **`CVE-2022-41080`** and **`CVE-2022-41082`**, then used newly observed custom .NET utilities to accelerate victim profiling and data access before encryption. One tool, **Grixba**, surveys domain users, computers, software, services, security products, backup platforms, and remote administration tools, and can also clear logs on local and remote systems; another uses the **AlphaVSS** library to copy files from **Volume Shadow Copy Service** snapshots, including files normally locked by the operating system. Reverse-engineering of the Play encryptor shows a ransomware family built for enterprise attacks, using a hybrid **RSA-AES** scheme, heavy obfuscation, API hashing, and anti-analysis techniques. The malware has been linked with tools and access methods including **SystemBC RAT**, **Cobalt Strike**, **AdFind**, **WinPEAS**, **WinSCP**, **RDP**, and **SMB**, and it enumerates local and network drives, skips selected files and directories, encrypts files in size-based chunks, appends the **`.PLAY`** extension, and drops a **`ReadMe.txt`** ransom note. Researchers also noted a coding flaw that can cause files to be renamed even when encryption does not complete successfully, underscoring both the malware’s sophistication and its ongoing evolution.
Aug 15, 2026
Play/PlayCrypt ransomware operators have used a repeatable double-extortion workflow beginning with compromised administrator credentials and RDP access. In two examined intrusions, the actors manually identified valuable data, archived it with WinRAR using the distinctive `-ep1 -scul -r0` options, and exfiltrated it through WinSCP. One operation was disrupted before encryption but continued data theft after defenders disabled an account; another reached encryption on more than 15 systems within roughly six hours, using PsExec to deploy distinct ransomware payloads from `C:\Users\Public\Music\`, disabling Windows protections, and deleting shadow copies. The group, active since 2022 and responsible for roughly 900 known victim entities as of May 2025, also gains entry through exposed applications, including FortiOS, Microsoft Exchange ProxyNotShell, and activity associated with SimpleHelp `CVE-2024-57727`. Its tooling includes Grixba for domain-wide discovery and inventory of security, backup, and remote-management products, plus a custom VSS utility that copies locked files from shadow snapshots before encryption. Defenders should prioritize MFA and rapid remediation of internet-facing vulnerabilities, while monitoring for the WinRAR command-line pattern, WinSCP transfers, Defender exclusions, random service creation, PsExec activity, and executable writes under the Public Music directory; offline immutable backups and network segmentation remain essential to limit impact.
Sep 20, 2026
Researchers report that **LockBit has resumed operations** with a new **LockBit 5.0** strain that targets **Windows, Linux, and VMware ESXi** systems, extending the group’s established cross-platform ransomware model after the disruption caused by Operation Cronos. Analysis of a newly discovered sample found strong code continuity with **LockBit 4.0**, indicating the malware is an evolution of the original codebase rather than a copycat. The new version adds heavy obfuscation, anti-analysis, and anti-forensics capabilities, including in-memory payload loading through DLL reflection, ETW patching, security service termination, and event log clearing, while the ESXi variant is built to encrypt virtualized environments at scale. Separate reporting ties LockBit activity to real-world intrusions and common access vectors. SecurityScorecard assessed a claimed attack on a major **state-owned Southeast Asian bank** and found network and malware evidence consistent with credential theft, **SSH/RDP-based access**, and possible data exfiltration before and after the victim appeared on LockBit’s leak site, though some public claims could not be independently verified. Another SecurityScorecard investigation found attackers exploiting **PaperCut** flaws **`CVE-2023-27350`** and **`CVE-2023-27351`**, with **`CVE-2023-27350`** used to deliver LockBit in observed cases, underscoring how the group and its affiliates continue to pair opportunistic vulnerability exploitation with mature, multi-platform ransomware tooling.
Aug 21, 2026