Threat actor · G1040

Play

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

ATT&CK techniques

26 mapped

T1003.001 T1016 T1018 T1021.002 T1027.010 T1030 T1048 T1057 T1059.001 T1059.003 T1070.004 T1078 T1078.002 T1078.003 T1082 T1083 T1105 T1133 T1190 T1518.001 T1560.001 T1587.001 T1588.002 T1657 T1685 T1685.005