Play
Closed-group ransomware operation (no public affiliate program) active since mid-2022, named for the '.play' extension appended to encrypted files. Heavy exploitation of FortiOS SSL-VPN flaws and Microsoft Exchange ProxyNotShell for initial access. CISA joint advisory in December 2023 estimated 300+ victims across North America, South America, and Europe.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
MITRE ATT&CK techniques
Timeline
6 events- ReportMedium2025-06-04·CISA
CISA documents Play ESXi variant and per-victim recompilation
The June 2025 update to AA23-352A formally documented Play's ESXi variant, which powers off virtual machines and encrypts VM-related files (.vmdk, .vmem, .vmsn, .vmx, .nvram, etc.) with AES-256, and confirmed that the Windows binary is recompiled for every attack to defeat hash-based detection. Each victim now receives a unique @gmx.de or @web.de contact address.
esxiadvisory-updatettps - AdvisoryHigh2023-12-18·CISA
Joint CISA/FBI/ASD advisory AA23-352A on Play ransomware
FBI, CISA, and the Australian Cyber Security Centre published joint advisory AA23-352A on the Play (Playcrypt) ransomware group, documenting initial-access via FortiOS (CVE-2018-13379, CVE-2020-12812) and Microsoft Exchange ProxyNotShell (CVE-2022-41040, CVE-2022-41082) bugs and the group's intermittent-encryption / double-extortion tradecraft. The advisory was updated on 4 June 2025 to note approximately 900 victims as of May 2025 and Play's exploitation of SimpleHelp CVE-2024-57727.
advisoryransomwareproxynotshellfortios - CompromiseHigh2023-02-08·BleepingComputer
City of Oakland ransomware attack claimed by Play
The City of Oakland, California disclosed a ransomware attack on 10 February 2023 that took most non-emergency municipal systems offline and prompted a local state of emergency. The Play group listed Oakland on its extortion site on 1 March 2023 and subsequently leaked data including employee personal information; the city later settled litigation covering more than 13,000 affected current and former employees.
municipaldata-extortionus - CompromiseMedium2023-01-23·BleepingComputer
A10 Networks breached by Play ransomware affiliates
Networking-hardware vendor A10 Networks disclosed that a Play ransomware affiliate accessed its shared drives and exfiltrated human-resources, finance, and legal data during a brief intrusion on 23 January 2023. A10 said operational systems and customers were not affected; Play listed the company on its leak site shortly afterwards.
data-extortionvendor - CompromiseHigh2022-12-23·Computer Weekly
Arnold Clark customer data stolen in Play ransomware attack
UK car retailer Arnold Clark was hit on 23 December 2022 by a double-extortion attack later claimed by the Play group, which asserted it had exfiltrated 467 GB of data. The stolen records included names, contact details, ID documents, and in some cases National Insurance numbers and bank account data; staff reverted to pen and paper while systems were rebuilt.
ukdata-extortionretail - CompromiseHigh2022-12-02·Cybersecurity Dive
Rackspace Hosted Exchange outage caused by Play ransomware
Rackspace's Hosted Exchange service went down on 2 December 2022, knocking email offline for approximately 30,000 SMB customers. A CrowdStrike-led investigation confirmed in early January 2023 that the Play ransomware group was responsible, using a previously unknown Exchange exploit chain dubbed 'OWASSRF' (CVE-2022-41080 + CVE-2022-41082). Rackspace later wound down the Hosted Exchange product.
exchangeowassrfmsp
Indicators of compromise
3 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| SHA-256 | family · SystemBC SHA-256 of a SystemBC malware DLL used by Play ransomware actors for SOCKS proxy / C2 traffic, listed in the June 2025 update to CISA/FBI/ACSC joint advisory AA23-352A (Table 2). | Jun 3, 2025 | CISA |
| SHA-256 | family · Playcrypt SHA-256 of an SVCHost.dll backdoor associated with Play ransomware operators, published in the June 2025 update to CISA/FBI/ACSC joint advisory AA23-352A (Table 2). | Jun 3, 2025 | CISA |
| SHA-256 | family · Grixba SHA-256 of the GRIXBA information-stealer / custom data gathering tool used by Play ransomware affiliates, published in the June 2025 update to CISA/FBI/ACSC advisory AA23-352A. | Jun 3, 2025 | CISA |
Related actors
shared ATT&CK techniques- RU · Russia8Base3 shared techniques
- ?? · UnknownAkira3 shared techniques
- ?? · UnknownHive3 shared techniques
- IR · IranPioneer Kitten3 shared techniques
- ?? · UnknownQilin3 shared techniques
- ?? · UnknownRansomHub3 shared techniques
References
cite this page
Threat Intel Tracker. (2026-05-19). Play — actor profile. Retrieved from https://threatintel.local/actors/play