play
Aliases: PlayCrypt
- First seen
- 2022-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-12 14:22:48
- Profile updated
- 2026-07-07 13:21:22
Targeted industries: energy-and-utilities government-and-public-sector healthcare-and-pharmaceutical manufacturing technology-and-telecommunications
Targeted regions: country_code:br country_code:mx country_code:ar
Context
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: "Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors." These tools make use of the following .NET frameworks (Costura, AlphaVSS).
Detection coverage
- 1 YARA rules
Detection rules
- MALPEDIA_Win_Play_Auto (yara-rule)
Reports & references
- Trend Micro — Ransomware Spotlight Play (report)
- sentinelone.com — Crimeware Trends Ransomware Developers Turn To Intermittent Encryption To Evade Detection (report)
- ransomlook.io — Play (report)
- chuongdong.com — Playransomware (report)
- Trend Micro — Play Ransomware S Attack Playbook Unmasks It As Another Hive Aff (report)
- noticeofpleadings.com — 1%20 Microsoft%20Cobalt%20Strike%20 %20Complaint(907040021.9) (report)
- bleepingcomputer.com — March 2023 Broke Ransomware Attack Records With 459 Incidents (report)
- intrinsec.com — Tlp Clear 31072025 Shadowsyndicate Infrastructure Illumination En (report)
- cert.ssi.gouv.fr — Certfr 2023 Cti 007 (report)
- medium.com — From Royal With Love 88Fa05Ff7F65 (report)
- Palo Alto Unit 42 — North Korean Threat Group Play Ransomware (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Play (report)
- adlumin.com — Playcrypt Ransomware As A Service Expands Threat From Script Kiddies And Sophisticated Attackers (report)
- bleepingcomputer.com — Rackspace Confirms Play Ransomware Was Behind Recent Cyberattack (report)
- avertium.com — An In Depth Look At Play Ransomware (report)
- kroll.com — Play Ransomware Gains Access Citrix Bleed Vulnerability (report)
- fortinet.com — Ransomware Roundup Play Ransomware (report)
- orangecyberdefense.com — Playing The Game (report)
- Broadcom/Symantec — Play Ransomware Volume Shadow Copy (report)