PLAY Ransomware: The Double-Extortion Gang

Play ransomware has been one of the most persistent ransomware operations since it first appeared in June 2022. Four years later, it is still listing new victims every month, and US authorities named it among the most active ransomware groups of 2024.

At its early peak, Trend Micro detected Play ransomware on as many as 170 machines in a single month. Since then, the group has claimed more than 1,300 victims on its leak site.

Let’s look at how Play gets in, how it moves through a network, and what you can do to stop it.

What is Play ransomware?

Since June 2022, Play (also known as PlayCrypt, and tracked by Symantec as Balloonfly) has attacked a wide range of businesses and critical infrastructure in North America, South America, and Europe.

The group takes its name from the .play extension it appends to encrypted files.

Play uses a double-extortion model: it exfiltrates an organization’s data first, then encrypts its systems, and threatens to publish the stolen data if the ransom isn’t paid.

Sources disagree on how the group is organized. The FBI and CISA describe Play as a presumed closed group that, according to its leak site, aims to “guarantee the secrecy of deals.” Other researchers, including Kroll, describe it as ransomware-as-a-service (RaaS). In October 2024, Palo Alto Networks’ Unit 42 also reported that North Korean state-linked actors appeared to be collaborating with Play, providing initial access that was later used to deploy the ransomware.

How active is Play ransomware in 2026?

Play remains active, though at a slower pace than in its peak years. According to Check Point Research, Play posted 121 victims in Q1 2026, a 64% increase on the previous quarter, placing it among the ten most active groups. In that quarter, 85.1% of its attacks targeted US organizations.

Activity has slowed in the second half of the year. HackerFeeds recorded 13 Play victims in September 2026 and 12 in the first 19 days of October, roughly 12 per month compared with about 40 per month in Q1.

Cumulative totals vary by tracker and methodology. As of mid-October 2026, leak-site trackers count around 1,300 claimed victims since 2022, while the FBI was aware of approximately 900 affected entities as of May 2025.

Who does Play ransomware target?

Play is opportunistic. It is often described as targeting large enterprises, but much of its victim list is made up of small and medium-sized organizations, managed service providers (MSPs), and government entities, according to Kroll.

Geographically, Play focuses heavily on the United States, followed by Europe, with victims also in Canada, the UK, and Australia. Post-Soviet countries don’t appear on its victim list, although there’s no direct evidence this is intentional.

In its early years, Trend Micro detections were concentrated in sectors such as telecommunications and healthcare (Figure 3). More recent leak-site data shows manufacturing, professional services, and technology as the most affected sectors. Organizations under operational pressure and holding large volumes of sensitive data remain attractive targets, because downtime and data exposure both increase pressure to pay.

How does Play ransomware work?

Play’s operations evolve regularly, which makes the group hard to disrupt. The June 2025 update to the joint FBI, CISA, and ASD advisory added new tactics and indicators, and noted that the FBI was aware of approximately 900 affected entities as of May 2025.

Play’s ransom note doesn’t state a ransom amount or payment instructions. Instead, it tells victims to contact the attackers by email. Ransoms are paid in cryptocurrency to wallets provided by the group.

Stages of a Play ransomware attack

1. Initial access. Play typically gets in by abusing valid accounts, likely bought on the dark web, or by exploiting internet-facing systems. The FBI and CISA have documented exploitation of known Fortinet FortiOS vulnerabilities (CVE-2018-13379 y CVE-2020-12812) and the Microsoft Exchange ProxyNotShell vulnerabilities (CVE-2022-41040 y CVE-2022-41082), as well as abuse of exposed RDP and VPN services.

More recent entry points include:

• Citrix Bleed: Kroll observed Play exploiting CVE-2023-4966 in Citrix NetScaler to breach a professional services firm.
• SimpleHelp RMM: Initial access brokers with ties to Play exploited CVE-2024-57727 in the SimpleHelp remote monitoring and management tool against many US organizations after its January 2025 disclosure.
• Windows zero-day: In 2025, Symantec found Play-linked operators exploiting CVE-2025-29824, a Windows Common Log File System privilege escalation flaw, before Microsoft patched it. The attackers likely entered through a public-facing Cisco ASA appliance.

2. Discovery and defense evasion. Once inside, Play uses AdFind, a third-party command-line tool for querying Active Directory, alongside Grixba, its custom information stealer, to map the network and scan for antivirus and security tools. It then uses tools such as GMER, IOBit, and PowerTool to disable antivirus software and delete logs, and PowerShell scripts to target Microsoft Defender.

3. Credential access and lateral movement. Play searches for unsecured credentials and uses Mimikatz to dump credentials and gain domain administrator access. It uses WinPEAS to find additional privilege escalation paths. To move laterally and run commands on other machines, it relies on command-and-control frameworks such as Cobalt Strike and SystemBC, remote execution tools such as PsExec, RDP, and remote access software such as AnyDesk. Plink is used to maintain persistent SSH tunnels.

4. Exfiltration. Play splits stolen data into segments, compresses it into .RAR archives with WinRAR, and transfers it to attacker-controlled accounts with WinSCP.

5. Encryption and extortion. The ransomware is distributed across the network through Group Policy Objects (GPOs). Files are encrypted using a hybrid AES-RSA scheme with intermittent encryption, which encrypts only portions of each file. This speeds up encryption and can help evade detection tools that rely on static analysis. System files are skipped so machines stay operational. Play recompiles its ransomware binary for each attack, so every sample has a unique hash.

A ransom note titled ReadMe.txt directs victims to an email address ending in @gmx[.]de o @web[.]de. If a victim refuses to pay, Play threatens to publish the stolen data on its Tor leak site. Some victims have also received threatening phone calls.

Play ransomware TTPs

The table below maps Play’s observed behavior to MITRE ATT&CK, based on the FBI/CISA/ASD advisory and Kroll’s incident analysis.

Táctica	Técnica	How Play uses it
Initial Access	T1078 Valid Accounts	Abuses stolen or purchased credentials
Initial Access	T1190 Exploit Public-Facing Application	Exploits FortiOS, Exchange, Citrix, and SimpleHelp vulnerabilities
Initial Access	T1133 External Remote Services	Uses exposed RDP and VPN services
Ejecución	T1059.001 PowerShell	Deploys tools and targets Microsoft Defender
Privilege Escalation	T1068 Exploitation for Privilege Escalation	Exploited CVE-2025-29824 as a zero-day
Defense Evasion	T1562.001 Disable or Modify Tools	Uses GMER, IOBit, and PowerTool to disable antivirus
Defense Evasion	T1070.001 Clear Windows Event Logs	Deletes logs to hide activity
Credential Access	T1552 Unsecured Credentials	Searches for credentials stored insecurely
Credential Access	T1003 OS Credential Dumping	Uses Mimikatz to obtain domain admin access
Discovery	T1016 System Network Configuration Discovery	Uses Grixba to map network settings
Discovery	T1518.001 Security Software Discovery	Scans for antivirus and security tools
Discovery	T1087.002 Domain Account Discovery	Enumerates domain accounts with AdFind
Lateral Movement	T1021.001 Remote Desktop Protocol	Moves between hosts over RDP
Lateral Movement	T1570 Lateral Tool Transfer	Distributes executables inside the network
Defense Evasion / Privilege Escalation	T1484.001 Group Policy Modification	Pushes the ransomware via GPOs
Command and Control	T1219 Remote Access Software	Maintains access with remote access tools
Colección	T1560.001 Archive via Utility	Compresses stolen data with WinRAR
Exfiltración	T1048 Exfiltration Over Alternative Protocol	Transfers data with WinSCP
Impacto	T1489 Service Stop	Stops backup and Exchange services
Impacto	T1486 Data Encrypted for Impact	Encrypts files with intermittent AES-RSA encryption
Impacto	T1657 Financial Theft	Extorts victims through double extortion

ESXi Linux variant

In July 2024, Trend Micro researchers discovered a Linux variant of Play ransomware built to target VMware ESXi. The variant runs ESXi-specific shell commands to power off all running virtual machines (VMs), list machine names, and replace the ESXi welcome message with the ransom note. Because a single ESXi host can run many business-critical VMs, this variant lets Play cause widespread disruption with one payload.

Common Play ransomware Indicators of Compromise (IoCs)

Play works hard to stay hidden, but its intrusions leave recognizable traces.

Watch for these observed Play ransomware IoCs:

• Custom reconnaissance tool: Grixba (seen as GT_NET.exe) enumerates users, computers, and installed security and remote-access software, then saves the results to CSV files compressed into a ZIP archive.
• Staging folders: Tools and exploits are often dropped in public user directories such as C:\Users\Public\Music, sometimes with names that impersonate legitimate security software.
• Remote execution and tunneling: Unexpected use of PsExec, Plink, AnyDesk, Cobalt Strike, or SystemBC, especially from servers or accounts that don’t normally use them.
• Security tool tampering: GMER, IOBit, or PowerTool on endpoints, PowerShell commands that disable Microsoft Defender, and cleared Windows event logs.
• Data staging and exfiltration: Large, segmented WinRAR archives followed by WinSCP transfers to external hosts.
• Suspicious GPO changes: New or modified Group Policy Objects that push executables across many hosts.
• Encryption and ransom note: Files renamed with the .play extension and a ReadMe.txt ransom note pointing to a @gmx[.]de o @web[.]de address.

Because Play recompiles its binary for each attack, file hashes go stale quickly. Prioritize behavioral detection and use the current IOC files published by CISA for threat hunting.

Defend against Play ransomware

Play relies on known vulnerabilities, exposed remote access, and legitimate tools. The FBI, CISA, and ASD recommend mitigations aligned with CISA and NIST’s Cross-Sector Cybersecurity Performance Goals. Here are the priorities:

• Patch known exploited vulnerabilities first. Prioritize internet-facing systems such as VPNs, firewalls, Citrix and Exchange servers, and RMM tools like SimpleHelp. Play has repeatedly exploited flaws that were patched years earlier.
• Enable multifactor authentication (MFA). CISA stresses MFA for all services where possible, particularly webmail, VPN, and accounts that access critical systems. Phishing-resistant MFA, such as FIDO security keys, offers the strongest protection.
• Use long, unique passwords. Follow NIST password guidance: favor long passwords, avoid reuse, and lock accounts after repeated failed logins. CISA advises against requiring password changes more than once a year, because frequent resets lead to predictable patterns.
• Lock down remote access. Restrict RDP and VPN access to authorized IP ranges, use conditional access and geo-fencing, and disable unused ports. Audit remote access and RMM tools, and remove any that aren’t approved.
• Tighten access controls. Apply the principle of least privilege, use just-in-time access for admin accounts, and regularly review domain controllers and Active Directory for new or unrecognized accounts.
• Segment your network. Segmentation limits how far ransomware can spread once an attacker is inside.
• Monitor network and endpoint activity. Use EDR and network monitoring to spot lateral movement, unusual GPO changes, large outbound transfers, and communication with known command-and-control servers.
• Maintain offline, immutable backups. Keep encrypted, immutable backups that cover all critical data, store them offline, and test restoration regularly. Protect ESXi hosts and their backups in particular.
• Implement a recovery plan. Follow NIST guidelines to define how you will detect, respond to, and recover from a ransomware incident.

The Play ransomware group continues to target businesses & #CriticalInfrastructure globally. Find new TTPs and IOCs in our updated Play Ransomware #Cybersecurity Advisory with @FBI & @ASDGovAu. 👉 https://t.co/fLN8E5ToPV #StopRansomware pic.twitter.com/PW5ZWRddry

— CISA Cyber (@CISACyber) June 4, 2025

Preguntas frecuentes

Terminando

Play has stayed active for four years by adapting: new entry points, new tools, and an ESXi variant. What hasn’t changed is its reliance on exposed edge devices, unpatched vulnerabilities, and compromised credentials. That’s also where defenders can stop it.

Like other major ransomware actors, Play is far easier to stop before it gets in than after. Detecting exposure early keeps an incident from escalating, protecting your daily operations and your customers’ data.

With CybelAngel, you can map and monitor your exposed assets with Gestión de la Superficie de Ataque, and identify exposed credentials before attackers use them with Inteligencia de Credenciales.