play

· ActiveInitially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

1,140

Status

Active

Sites

Countries Hit

Profile

[CISA Alert aa23-352a](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a)

Top Countries

US831

CA90

GB35

DE31

Unknown19

SE14

NL14

FR10

CH9

AU7

Top Sectors

Manufacturing281

Business Services204

Technology137

Construction102

Recent Victims

View all 1140 →

Landmark Rehab Group

US · Construction

Feb 27, 2026

BT Services

US · Construction

Feb 27, 2026

Integrity Building

US · Construction

Feb 27, 2026

Marwood

CA · Manufacturing

Feb 26, 2026

Arizona Lighting Sales

US · Manufacturing

Feb 26, 2026

Indianapolis Car Exchange

US · Transportation/Logistics

Feb 26, 2026

Oklahoma Auto Exchange

US · Retail