Play
A ransomware group active since 2022 and presumed by agencies to be closed, not an affiliate programme. The FBI knew of about 900 affected organisations by May 2025.
Threat actor profile. Last reviewed 3 November 2026.
Why It Matters
The FBI, CISA and Australia's ACSC say about 900 entities were affected as of May 2025.3 Play is presumed to be a closed group, and its leak site says this is to "guarantee the secrecy of deals".3
The pressure reaches ordinary staff. The advisory says victims get calls urging payment and threatening to publish data, including at help desk and customer service lines.3 Ransom notes carry no initial demand, so the first conversation is on the attacker's terms.3
Hash matching is a weak defence here, because the Windows binary is recompiled for each attack.3 Symantec also reports that attackers linked to Play used CVE-2025-29824 as a zero-day in an attempted attack on a US organisation, without deploying ransomware.2 The sources we opened do not establish a specific UK link beyond listing Europe as a region.4
Staff on front-line phone lines could be the first to hear of an attack. A short script for what to do if someone calls and threatens to release data costs little.
How It Attacks
Based on the FBI, CISA and ACSC advisory as updated in June 2025.3
- 1
Get In
Uses valid accounts, likely bought, RDP and VPN, and flaws in FortiOS and Exchange. Brokers linked to Play exploited SimpleHelp in 2025.
- 2
Discover
Uses AdFind, BloodHound, Nltest and the custom Grixba tool to map the network and security software.
- 3
Disable Defences
Uses tools such as GMER, IObit, PowerTool and HRsword, and PowerShell to target Microsoft Defender.
- 4
Take Credentials and Move
Uses Mimikatz, Cobalt Strike, SystemBC, PsExec and Plink.
- 5
Steal the Data
Splits and compresses data with WinRAR, then moves it with WinSCP to attacker accounts.
- 6
Encrypt
Uses intermittent encryption. An ESXi variant powers off VMs and encrypts VM files.
- 7
Pressure
Requires victims to make contact by email, threatens a leak site and phones the organisation.
Key Techniques
Selected from the group's ATT&CK v20 entry8 and the Playcrypt software entry.1
| ID | Technique | Tactic | What It Looks Like |
|---|---|---|---|
| T1078 | Valid Accounts | Initial Access | Valid VPN accounts. |
| T1133 | External Remote Services | Initial Access | RDP and VPN. |
| T1190 | Exploit Public-Facing Application | Initial Access | Flaws in FortiOS and Exchange. |
| T1003.001 | LSASS Memory | Credential Access | Mimikatz and Task Manager. |
| T1685 | Disable or Modify Tools | Defense Impairment | GMER, IOBit and PowerTool. |
| T1021.002 | SMB/Windows Admin Shares | Lateral Movement | Cobalt Strike over SMB. |
| T1560.001 | Archive via Utility | Collection | WinRAR. |
| T1048 | Exfiltration Over Alternative Protocol | Exfiltration | WinSCP to actor-controlled accounts. |
| T1490 | Inhibit System Recovery | Impact | Deletes shadow copies. |
| T1486 | Data Encrypted for Impact | Impact | AES-RSA hybrid encryption. |
Tools Observed
Custom
Discovery
Defence Evasion
Credentials and Movement
Data Theft
From the joint advisory, which notes that these legitimate tools should not be treated as malicious without supporting evidence.4,3
Vulnerabilities
From the joint advisory3 and Symantec.2
If you cannot patch Exchange, the advisory says to disable Outlook Web Access.4
Key Events
Campaign begins.4
Joint advisory first published.3
SimpleHelp flaw disclosed, then exploited by brokers linked to Play.3
Symantec reports zero-day use of CVE-2025-29824 by Play-linked attackers.2
Advisory updated: about 900 entities, phone pressure and an ESXi variant.3
Arete says Play remained among the most active groups.5
Check Point records a sharp drop from the first quarter, with most victims in the US.6
BlackFog logs a further Play claim. The organisation confirmed an attack but not Play's involvement.7
Warning Signs
From the joint advisory.3 Filenames and hashes change, so look at behaviour.
- Calls to help desk or customer service lines threatening to release company data
- PowerShell commands aimed at Microsoft Defender
- WinRAR splitting data followed by WinSCP transfers
- Tools such as GMER, PowerTool or HRsword on servers
- ESXi welcome messages changed to a ransom note
Defences That Matter
Harden Remote Access
- Require MFA for webmail, VPNs and critical accounts.3
- Filter inbound traffic to remote services.3
- Use strong passwords of 15 to 64 characters.3
Patch What Is Named
- Prioritise known exploited vulnerabilities on internet-facing systems.3
- Review RMM tools, including SimpleHelp, and who runs them on your behalf.
Detect Behaviour, Not Hashes
- Use EDR and network monitoring to spot lateral movement.3
- Audit admin accounts and use just-in-time privileged access.3
Prepare Staff and Recovery
- Tell front-line staff how to handle and escalate threatening calls.
- Keep encrypted, immutable, offline backups, including for ESXi, and test restores.3
Would Your Help Desk Know What to Do With a Threatening Call?
We can test your people and controls against the methods in this profile, and then help you close the gaps.
Sources
- MITRE ATT&CK: Playcrypt (S1162), ATT&CK v20
- Symantec Threat Hunter Team: research on Play-linked attackers and a Windows zero-day, 7 May 2025
- FBI, CISA and ASD's ACSC: #StopRansomware: Play Ransomware, AA23-352A, updated 4 June 2025
- FBI, CISA and ASD's ACSC: #StopRansomware: Play Ransomware, AA23-352A, web version
- Arete: Ransomware Trends and Data Insights, March 2026, 6 April 2026
- Check Point Research: The State of Ransomware Q2 2026, covering April to June 2026
- BlackFog: The State of Ransomware 2026, running log of claimed attacks, read 3 November 2026
- MITRE ATT&CK: Play (G1040), ATT&CK v20
- CISA Known Exploited Vulnerabilities catalogue, version 2026.10.30
MITRE ATT&CK® and ATT&CK® are registered trademarks of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. ATT&CK terms of use.