play ransomware group
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play…
- Claims in 7 days
- 4
- Claims in 30 days
- 19
- Reported techniques
- 32
Listings on leak sites are claims by criminals. They are unverified and can be false. coldbraid shows counts here, not names.
Where it claims victims
| Country | Claims in 60 days |
|---|---|
| United States | 9 |
| United Kingdom | 1 |
| Argentina | 1 |
| Canada | 1 |
| Denmark | 1 |
| Belgium | 1 |
| Hong Kong SAR China | 1 |
Sectors
| Sector | Claims in 60 days |
|---|---|
| Technology | 5 |
| Financial Services | 4 |
| Retail & E-Commerce | 2 |
| Transportation | 2 |
| Manufacturing | 2 |
| Hospitality | 1 |
| Other | 1 |
| Professional Services | 1 |
Reported techniques
Valid AccountsExternal Remote ServicesExploit Public-Facing ApplicationScheduled Task/JobCommand and Scripting InterpreterObfuscated Files or InformationIndicator RemovalOS Credential DumpingUnsecured CredentialsSystem Network Configuration DiscoveryRemote System DiscoveryNetwork Service DiscoveryProcess DiscoverySystem Information DiscoveryFile and Directory DiscoveryAccount DiscoverySoftware DiscoveryRemote ServicesLateral Tool TransferArchive Collected DataData Transfer Size LimitsExfiltration Over Alternative ProtocolIngress Tool TransferRemote Access ToolsData Encrypted for ImpactService StopInhibit System RecoveryFinancial TheftDevelop CapabilitiesObtain CapabilitiesDomain or Tenant Policy ModificationDisable or Modify Tools