Home › Threat Actors › Play
← All Threat Actors
Nation-State high Unattributed to a specific state or region

Play

CISA/FBI/ACSC and most vendors describe Play as a closed, private group that controls negotiations directly, per the group's own leak-site statement. A single November 2023 Adlumin report argued it had shifted toward a RaaS/affiliate model — not independently corroborated since. Operating model is unresolved. · Financial — double extortion

Reports 1
Active Since June 2022
Last Reported 18 Sept 2026
Sectors Targeted professional-services, manufacturing, critical-infrastructure, construction

Tactics, Techniques & Procedures (TTPs)

  • Initial access via purchased valid accounts; FortiOS (CVE-2018-13379, CVE-2020-12812); ProxyNotShell (CVE-2022-41040/41082)
  • Since June 2025: SimpleHelp RMM chain (CVE-2024-57727/57726/57728) via initial-access brokers
  • AdFind, Grixba, BloodHound for recon; GMER/IOBit/PowerTool to blind security tools
  • Hybrid AES-RSA encryption with intermittent (every-other-chunk) encryption, .PLAY extension; binary recompiled per attack
  • ESXi variant (added June 2025): AES-256, powers off VMs before encrypting datastores
  • Distinctive extortion: no ransom amount or negotiation portal in the note — victims emailed to a gmx.de/web.de address
  • Tooling per CISA AA23-352A: Cobalt Strike, SystemBC, PsExec, Plink, Mimikatz, WinPEAS, Nekto/PriviCMD, WinRAR, WinSCP; custom HRsword.exe to disable endpoint protection
  • Phone calls to victims' help desks as pressure; Group Policy modification; event log clearing; payment demanded in cryptocurrency

Known Targets

Financial services and manufacturing, mainly in the US, UK and Italy (SOCRadar, aggregator)Wide range of businesses and critical infrastructure, North/South America and Europe (per CISA)Leak-site claims (unverified): Esquire Brands, Garner Foods/Texas Pete, Locati Architects, Silicon Valley Glass (Oct 2026)

Analyst Notes

CISA's last update (4 June 2025) counted about 900 victims; ProvenData reports 1,277 leak-site claims as of 13 July 2026 (low-medium confidence). CISA and MITRE G1040 list only "Play" and "Playcrypt" as names. CORRECTED: the earlier aliases Balloonfly (Symantec), Safeplay and "MITRE group G1040" (a reference, not an alias) were not found in the CISA/MITRE sources reviewed and Balloonfly was not checked; they are removed as aliases. The Symantec Balloonfly usage is a vendor cluster name and should not be merged with Play unless a source does so. Phishing (T1566) is not in the CISA or MITRE lists and was removed. The October 2026 leak-site victims were not corroborated in this pass. Microsoft's Storm-2460 cluster used CVE-2025-29824 to deliver PipeMagic; Symantec explicitly distinguishes it from the Play intrusion it analysed, so 'Storm-2460 = Play' is unconfirmed. MITRE's current G1040 page appears to use renumbered IDs for tool-disabling and log-clearing; verify IDs before reuse. No confirmed arrest, sanction or indictment naming Play was identified.

Also Known As

Playcrypt (CISA, MITRE software S1162)

MITRE ATT&CK Techniques

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1562.001 Impair Defenses: Disable or Modify Tools T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1133 External Remote Services T1484.001 Group Policy Modification T1070.001 Clear Windows Event Logs T1003 OS Credential Dumping T1570 Lateral Tool Transfer T1560.001 Archive via Utility T1048 Exfiltration Over Alternative Protocol T1657 Financial Theft

Intelligence Reports

Analysis professional-servicesmanufacturing

Play Ransomware Doesn't Negotiate Like Anyone Else — and It's Still Running

No ransom amount in the note, no negotiation chat portal, just a Gmail-style address and a deadline. Play has stayed active since mid-2022 with no confirmed law enforcement disruption, and its operating model is still disputed among the researchers tracking it.

18 Sept 2026 · 8 min read