Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.12
- CISA Play Ransomware Advisory December 2023
- Trend Micro Ransomware Spotlight Play July 2023
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Play | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1030 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2024 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685 | 2024 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1016 | System Network Configuration Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027.010 | Command Obfuscation | — |
| T1030 | Data Transfer Size Limits | — |
| T1048 | Exfiltration Over Alternative Protocol | — |
| T1057 | Process Discovery | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1070.004 | File Deletion | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1078.003 | Local Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1190 | Exploit Public-Facing Application | — |
| T1518.001 | Security Software Discovery | — |
| T1560.001 | Archive via Utility | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
| T1685 | Disable or Modify Tools | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
Play
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.