- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Seen
- 2022–2026
- Status
- Active
- ATT&CK
- G1040 · 26 techniques
- Sources
- 4 sources carry it
- Identifier
- GINC-APT-0567 · play
What it is
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Other names
- Play Ransomware, PlayCrypt
Targets
- Sectors
- Education, Government, Healthcare, Technology
Tools
The tools and malware families the sources tie to it.
- AdFind
- Archelaus Beta
- BloodHound
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- Empire
- Mimikatz
- Nltest
- Playcrypt
- PsExec
- Remote Utilities
- RemoteCMD
- RemotePC
- Wevtutil
Sources
- MITRE ATT&CK attack.mitre.org