Play Ransomware

Play ransomware first emerged in June 2022 and has rapidly become one of the most active ransomware groups globally. The Play ransomware group targets critical infrastructure, large enterprises, and businesses across North America, South America, and Europe. The name “Play” comes from the “.play” file extension used to mark encrypted files during a ransomware attack.

Play ransomware actors employ a double extortion model. They encrypt data and exfiltrate sensitive information, threatening to release it on their group’s data leak site. This tactic has made Play ransomware attacks especially challenging for organisations in various sectors.

The Play ransomware group uses a range of techniques to gain initial access. Threat actors may exploit known vulnerabilities in FortiOS, Microsoft Exchange, or use credentials obtained from initial access brokers. Once inside, Play actors move laterally through networks using tools like AnyDesk, NetScan, and Cobalt Strike. The group often targets Active Directory, uses group policy objects, and employs intermittent encryption, encrypting only parts of system files or data to avoid detection by antivirus programs and endpoint protection tools.