Ransomware.live play

Play

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.

On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs

External information

CISA Alert aa23-352a

Victims

915

First Discovered

victim

2022-11-26

Last Discovered

victim

2025-06-14

Avg Delay

between attack and claim

22.3 days

Infostealer

for victim with domain

4.5%

View Victims on World Map

Known Locations (4)

Title	Available	Last Visit	FQDN
PLAY NEWS	Yes	2025-06-15 09:31:08	`mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion`
PLAY NEWS	Yes	2025-06-15 09:32:15	`k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion`
PLAY NEWS	Yes	2025-06-15 09:01:14	`mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion`
PLAY NEWS	Yes	2025-06-15 09:33:22	`j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion`

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
AdFind WKTools placeholder	placeholder placeholder placeholder	GMER IOBit PowerTool	Mimikatz placeholder placeholder	Cobalt Strike WinPEAS placeholder	Plink placeholder placeholder	PsExec placeholder placeholder	WinSCP placeholder placeholder

Play

External information

Victims

915

First Discovered

2022-11-26

Last Discovered

2025-06-14

Avg Delay

22.3 days

Infostealer

4.5%

Known Locations (4)

Target (Available)

Heatmap (Available)

Ransom Notes (3)

Tools Used (Available)

Vulnerabilities Exploited (0)

TTPs Matrix (0)

Negotiation Chats (0)

YARA Rules (1)

Indicators of Compromise (IoCs) (0)

Victims (915)