Threat Actors Play

Play

G1040 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Description

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

AI Analysis

· 1 week ago

Executive Summary

Play is a ransomware group active since at least November 2022, deploying Playcrypt ransomware against various sectors globally. They employ double extortion tactics, encrypting systems after exfiltrating data, and are suspected to operate as a closed group with high sophistication. Their campaigns have targeted businesses, governments, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe.

Goals & Targeting

Play's primary goals appear to be financial gain through ransom payments, coupled with the disruption of targeted organizations. They focus on sectors with high systemic importance or those they perceive as having limited defenses, such as critical infrastructure, healthcare, and small-to-medium businesses. Their targeting strategy suggests a preference for geographic regions with weaker cybersecurity frameworks and a focus on maximizing payouts while minimizing operational risk.

Enhanced Description

Play is a sophisticated ransomware group that has been active since at least November 2022. The group operates using a double-extortion model, where they both encrypt systems and exfiltrate data before demanding ransoms for its release. Playcrypt, their primary malware, targets critical sectors such as business, government, healthcare, media, and critical infrastructure in North America, South America, and Europe. Security researchers have observed their campaigns using a combination of phishing, remote exploitation, and brute-force attacks to gain initial access to victim networks. Once inside, they deploy Playcrypt to encrypt files and use tools like Cobalt Strike for lateral movement and persistence. Their operations demonstrate both technical proficiency and strategic planning, aligning with the broader trend of ransomware groups increasingly targeting critical infrastructure and healthcare sectors for maximum impact.

Key Capabilities

Ransomware deployment (Playcrypt)
Double extortion tactics
Data exfiltration
Phishing campaigns
Remote system exploitation
Lateral movement using Cobalt Strike
Network persistence strategies

MITRE ATT&CK Tactics

Initial Access

Execution

Persistence

Defense Evasion

Credential Access

Discovery

Lateral Movement

Exfiltration

Impact

ATT&CK Techniques

T1560.001

T1133

T1587.001

T1190

T1003.001

T1685.005

T1083

T1030

T1059.001

T1588.002

T1078.002

T1518.001

T1059.003

T1027.010

T1070.004

T1018

T1078.003

T1082

T1021.002

T1016

T1657

T1057

T1048

T1016

Software / Tooling

Playcrypt ransomware

Cobalt Strike

Windows Command Shell

PowerShell

LSASS Memory Dumping Tools

Process Discovery Tools

Campaigns & Victims

Play has conducted numerous campaigns targeting a wide range of industries, including healthcare providers and construction companies. Their operational tempo suggests a focus on scalability and efficiency, often compromising multiple victims within short periods. Notable campaigns include attacks on entities such as Barnes Solicitors LLP, Colorado Construction, and Lucky Look. Play's ability to adapt their tactics, such as using Cobalt Strike for lateral movement and employing obfuscation techniques, highlights their operational maturity. Their victims are typically organizations with limited defenses or those in sectors where downtime has significant consequences.

IOC Patterns

Spear-phishing emails with malicious attachments
Use of remote access tools like Cobalt Strike
Data exfiltration via alternative protocols (e.g., FTP, HTTP)
Scheduled task creation for persistence
Volume shadow copy deletion

Recommended Actions

Implement robust endpoint detection and response (EDR) solutions to detect Play's TTPs.
Monitor for anomalous network activity, particularly remote access attempts and data exfiltration.
Regularly backup critical systems and ensure backups are air-gapped or securely stored.
Conduct phishing simulations to improve employee awareness of social engineering tactics.
Limit RDP and远程桌面服务 (RDS) access to only essential services and use multi-factor authentication.

Suggested Tags

ransomware

double extortion

critical infrastructure

healthcare sector

APT23

Confidence Assessment

There is a high confidence in Play's association with the described activities due to consistent reporting from multiple sources, including CISA and Trend Micro. However, specific details about their internal structure and exact geographic origin remain unclear, which introduces some uncertainty in their long-term strategic goals.

ATT&CK Techniques

Collection

1 technique

T1560.001

Archive via Utility

Play has used WinRAR to compress files prior to exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Command & Control

1 technique

T1105

Ingress Tool Transfer

Play has used Cobalt Strike to download files to compromised machines.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Credential Access

1 technique

T1003.001

LSASS Memory

Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Defense impairment

2 techniques

T1685

Disable or Modify Tools

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1685.005

Clear Windows Event Logs

Play has used tools to remove log files on targeted systems.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Discovery

6 techniques

T1016

System Network Configuration Discovery

Play has used the information-stealing tool Grixba to enumerate network information.(Citation: CISA Play Ransomware Advisory December 2023)

T1018

Remote System Discovery

Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1057

Process Discovery

Play has used the information stealer Grixba to check for a list of security processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1082

System Information Discovery

Play has leveraged tools to enumerate system information.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1083

File and Directory Discovery

Play has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1518.001

Security Software Discovery

Play has used the information-stealing tool Grixba to scan for anti-virus software.(Citation: CISA Play Ransomware Advisory December 2023)

Execution

2 techniques

T1059.001

PowerShell

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1059.003

Windows Command Shell

Play has used a batch script to remove indicators of its presence on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Exfiltration

2 techniques

T1030

Data Transfer Size Limits

Play has split victims' files into chunks for exfiltration.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1048

Exfiltration Over Alternative Protocol

Play has used WinSCP to exfiltrate data to actor-controlled accounts.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Impact

1 technique

T1657

Financial Theft

Play demands ransom payments from victims to unencrypt filesystems and to not publish sensitive data exfiltrated from victim networks.(Citation: CISA Play Ransomware Advisory December 2023)

Initial Access

1 technique

T1190

Exploit Public-Facing Application

Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Lateral Movement

1 technique

T1021.002

SMB/Windows Admin Shares

Play has used Cobalt Strike to move laterally via SMB.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Persistence

1 technique

T1133

External Remote Services

Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Resource Development

2 techniques

T1587.001

Malware

Play developed and employ Playcrypt ransomware.(Citation: Trend Micro Ransomware Spotlight Play July 2023)(Citation: CISA Play Ransomware Advisory December 2023)

T1588.002

Tool

Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.(Citation: CISA Play Ransomware Advisory December 2023)

Stealth

5 techniques

T1027.010

Command Obfuscation

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1070.004

File Deletion

Play has used tools including Wevtutil to remove malicious files from compromised hosts.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1078

Valid Accounts

Play has used valid VPN accounts to achieve initial access.(Citation: CISA Play Ransomware Advisory December 2023)

T1078.002

Domain Accounts

Play has used valid domain accounts for access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)

T1078.003

Local Accounts

Play has used valid local accounts to gain initial access.(Citation: Trend Micro Ransomware Spotlight Play July 2023)