Play
Since Nov 26, 2022, Play has listed 1,369 organizations on its leak site.
Listings per month
- Total listings
- 1,369
- First listing
- Nov 26, 2022
- Latest listing
- Nov 4, 2026
- MITRE ATT&CK techniques
- 54
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'
It posted 279 listings in the last 12 months; the busiest month was March 2026 (46 listings).
Most targeted country: United States, with 967 listings (71% of the total).
Most targeted sector: Manufacturing, with 360 listings (26% of the total).
Targeted countries
Showing 10 of 1,369 results
54 MITRE ATT&CK techniques across 15 stages are documented in the group's attacks.
- 1
Resource development
Infrastructure, accounts and tools for the attack are prepared.
T1587.001Develop Capabilities: MalwareT1588.002Obtain Capabilities: Tool - 2
Initial access
The attacker gets into the corporate network for the first time.
T1078Valid AccountsT1078.002Valid Accounts: Domain AccountsT1078.003Valid Accounts: Local AccountsT1133External Remote ServicesT1190Exploit Public-Facing Application - 3
Execution
Malicious code runs on the target system.
T1053.005Scheduled Task/Job: Scheduled TaskT1059Command and Scripting InterpreterT1059.001Command and Scripting Interpreter: PowerShellT1059.003Command and Scripting Interpreter: Windows Command Shell - 4
Persistence
Access survives reboots and password changes.
T1078.002Valid Accounts: Domain AccountsT1078.003Valid Accounts: Local AccountsT1133External Remote Services - 5
Privilege escalation
The attacker moves to accounts with higher privileges.
T1078.002Valid Accounts: Domain AccountsT1078.003Valid Accounts: Local Accounts - 6
Defense evasion
Security software and logging are bypassed.
T1027Obfuscated Files or InformationT1070Indicator RemovalT1070.001Indicator Removal: Clear Windows Event LogsT1484Domain or Tenant Policy ModificationT1484.001Domain or Tenant Policy Modification: Group Policy ModificationT1562.001Disable or Modify Tools - 7
Credential access
Passwords, tokens and session data are stolen.
T1003OS Credential DumpingT1003.001OS Credential Dumping: LSASS MemoryT1003.003OS Credential Dumping: NTDST1552Unsecured Credentials - 8
Discovery
Systems, accounts and data on the network are mapped.
T1016System Network Configuration DiscoveryT1018Remote System DiscoveryT1046Network Service DiscoveryT1057Process DiscoveryT1082System Information DiscoveryT1083File and Directory DiscoveryT1087.002Account Discovery: Domain AccountT1518Software DiscoveryT1518.001Software Discovery: Security Software Discovery - 9
Lateral movement
The attacker moves to other systems inside the network.
T1021.001Remote Services: Remote Desktop ProtocolT1021.002Remote Services: SMB/Windows Admin SharesT1570Lateral Tool Transfer - 10
Collection
Data to be stolen is selected and gathered.
T1560Archive Collected DataT1560.001Archive Collected Data: Archive via Utility - 11
Command and control
Compromised systems are controlled remotely.
T1105Ingress Tool TransferT1219Remote Access Software - 12
Exfiltration
Data is moved out of the organization; the threat to publish it in the listing relies on this data.
T1030Data Transfer Size LimitsT1048Exfiltration Over Alternative Protocol - 13
Impact
Systems are encrypted or services are stopped.
T1486Data Encrypted for ImpactT1489Service StopT1490Inhibit System RecoveryT1657Financial Theft - 14
Other techniques
T1027.010Obfuscated Files or Information: Command ObfuscationT1070.004Indicator Removal: File DeletionT1078.002Valid Accounts: Domain AccountsT1078.003Valid Accounts: Local AccountsT1685Disable or Modify ToolsT1685.005Disable or Modify Tools: Clear Windows Event Logs
What does a ransomware group do?
Ransomware groups break into corporate networks, move data out and encrypt systems. If the ransom is not paid, they list the organization on a leak site and threaten to publish the data.
How does Play get into organizations?
The attacker gets into the corporate network for the first time.
- T1078 · Valid Accounts
- T1078.002 · Valid Accounts: Domain Accounts
- T1078.003 · Valid Accounts: Local Accounts
- T1133 · External Remote Services
- T1190 · Exploit Public-Facing Application
Which defenses matter most?
Priority defenses based on the documented techniques:
- Keep internet-facing VPN, remote desktop and firewall interfaces patched, and require multi-factor authentication on these accounts.
- Allow scripts and macros only for users who need them, and keep behavioral rules enabled in endpoint protection.
- Monitor newly created services, scheduled tasks and startup entries.
- Reduce local administrator accounts and perform privileged tasks from separate, monitored accounts.
- Alert when security software is disabled or logs are cleared.
- Regularly check whether employee passwords and session cookies appear in infostealer logs.
- Monitor accounts that run many queries in a short time and unusual network scans.
- Segment the network and expose management protocols only on the management network.
- Monitor large file archiving operations.
- Block unapproved use of remote management tools.
- Monitor unusual data volumes sent to cloud storage and file transfer services.
- Keep offline, immutable backups and test restores regularly.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.