threatintel
actor tracker
IOC pivot
ioc · sha-256

47B7B2DD88959CD7224A5542AE8D5BCE928BFC986BF0D0321532A7515C244A1E

?? · UnknownPlayconfidence · high

SHA-256 of an SVCHost.dll backdoor associated with Play ransomware operators, published in the June 2025 update to CISA/FBI/ACSC joint advisory AA23-352A (Table 2).

family
Playcrypt
first seen
Jun 3, 2025
publisher
CISA
source citation