Play
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.
- ATT&CK ID
- G1040
- Techniques
- 22
- Tools
- 9
Vulnerabilities it has exploited
- CVE-2018-13379 Fortinet FortiOSUnscored · exploited in the wild
- CVE-2020-12812 Fortinet FortiOSUnscored · exploited in the wild
- CVE-2022-41040 Microsoft Exchange ServerUnscored · exploited in the wild
- CVE-2022-41082 Microsoft Exchange ServerUnscored · exploited in the wild
Techniques
Resource Development
Develop CapabilitiesObtain Capabilities
Initial Access
Valid AccountsExternal Remote ServicesExploit Public-Facing Application
Execution
Command and Scripting Interpreter
Persistence
Valid AccountsExternal Remote Services
Privilege Escalation
Stealth
Obfuscated Files or InformationIndicator RemovalValid Accounts
Defense Impairment
Credential Access
Discovery
System Network Configuration DiscoveryRemote System DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoverySoftware Discovery
Lateral Movement
Collection
Command and Control
Exfiltration
Data Transfer Size LimitsExfiltration Over Alternative Protocol
Impact
Software
AdFind · BloodHound · Cobalt Strike · Empire · Mimikatz · Nltest · Playcrypt · PsExec · Wevtutil