Play Ransomware — Ransomware Profile
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.Description reproduced from MITRE ATT&CK. © The MITRE Corporation, reproduced and distributed with permission.
Also tracked as
Play, Playcrypt, Balloonfly
IntelFusions coverage (4)
- Hacked Korean websites pushed spy backdoors and Gunra ransomware 2026-07-30 · Nation-State
- North Korean Andariel Group Linked to Play Ransomware in Unprecedented Nation-State Collaboration 2026-02-16 · Ransomware
- Andariel Acted as Play Ransomware Precursor in Five-Month Network Siege, Unit 42 Reveals 2026-02-16 · Nation-State
- Play Ransomware (Playcrypt): FBI/CISA/ASD Joint Advisory on Closed-Group Double Extortion Operation Impacting 900+ Entities Across North America, South America, Europe, and Australia 2026-02-16 · Ransomware
Tools & malware
- AdFind Network Reconnaissance
- BloodHound Network Reconnaissance
- Cobalt Strike Adversary Simulation
- Empire Post-Exploitation Framework
- Grixba infostealer / network enumeration tool
- Mimikatz Credential Harvesting
- Nltest Network Reconnaissance
- Playcrypt Ransomware
- PsExec Remote Execution
- VSS Copying Tool shadow-copy file access utility (.NET, AlphaVSS)
- Wevtutil Discovery
Recent claimed victims
- WSBI-ESBG 2026-10-16
- New Tec Tool Limited 2026-10-16
- MicroSearch Corporation 2026-10-16
- Pure Options 2026-10-16
- The Innovation Group 2026-10-13
- DFK Group 2026-10-13
- Saddlers Court MFG 2026-10-13
- Culinary Specialties 2026-10-13
- Advanced Imaging Solutions 2026-10-13
- Bold Spring Nursery 2026-10-04
- Silicon Valley Glass 2026-10-04
- Titus 2026-09-30
- Airtech Mechanical Services 2026-09-30
- Orth Automobile 2026-09-30
- Starr Whitehouse Landscape Architects 2026-09-28
- Ever Ready First Aid 2026-09-28
- Metallco 2026-09-21
- Hurley 2026-09-21
- Vista Plastic Solutions 2026-09-18
- Inglewood Golf 2026-09-18
- Barrett Mahony Consulting Engineers 2026-09-18
- Sys-kool 2026-09-10
- Grunthal Welding & Supplies 2026-09-10
- Red Star Oil 2026-09-08
- GT Distributors 2026-09-08
Vendor research
- Play Ransomware Group Using New Custom Data-Gathering Tools Symantec Threat Hunter Team
- New Play Ransomware Linux Variant Targets ESXi Shows Ties With Prolific Puma Trend Micro
- Ransomware Attackers Leveraged Privilege Escalation Zero-day Symantec
- #StopRansomware: Play Ransomware AA23-352A CISA
- Ransomware Spotlight: Play Trend Micro