Dark Web Profile: Play Ransomware

While cyber-attacks are increasing nowadays, threat actors seek to implement different methods and techniques as well. Ransomware is one of the most common cyber-attacks that are not new but developing a cybercrime industry that threatens several sectors and governments. Today, we’ll introduce you to a new player: Play Ransomware.

Who is Play Ransomware?

On Jun 22, 2022, in the BleepingComputer forum, someone wrote that his files were encrypted with the extension “Play.” Afterward, Trend Micro published an analysis article about the new ransomware variant, Play Ransomware. The main target of Play Ransomware is the Latin American region, and Brazil is at the top of the list. Even though they seem like a new ransomware group, their identified TTPs look like Hive and Nokayawa ransomware families. One of the similar behaviors that make them look similar are they use AdFind, a command-line query tool capable of collecting information from Active Directory.

How Do They Attack?

The Play Ransomware group uses a known valid account, exposed RDP servers, and FortiOS vulnerabilities CVE-2018-13379 and CVE-2020-12812 to gain initial access to an organization’s network. After getting access, they start using “lolbins” binaries like common ransomware group use as part of their attacks.

They distribute executables in the internal network via Group Policy Objects, then run scheduled tasks, PsExec or wmic. After they gain full access to the internal network, they encrypt files with the “.play” extension.

Figure 2. Play Ransomware infection chain (Source: Trend Micro)

Double extortion is a popular technique in which cyber actors threaten to exfiltrate sensitive data. Play Ransomware also uses double extortion against its victims. They can archive the breached data with WinRAR and then upload it to file-sharing sites.

Unique Type of Method: Intermittent Encryption

The researchers have found that the Play Ransomware group is the first threat actor resorting to intermittent encryption. This technique provides better evasion with partial encryption on the system that uses static analysis to detect ransomware infection.

Intermittent encryption is a new technique; based on the file size, it encrypts chunks of 0x100000 bytes.

For example:

2 chunks if the file size is less than or equal to 0x3fffffff bytes;
3 chunks if the file size is less than or equal to 0x27fffffff bytes;

The researchers observed that a sample encrypted every other 0x100000 byte chunk until the end of the file. The file consisted only of null characters, making the encrypted and non-encrypted chunks visually distinguishable.

Figure 3: Partial content of a file encrypted by PLAY (Source: SentinelOne)

Play Ransomware Attack Target: Argentina’s Judiciary of Córdoba

Figure 4. Argentina’s Judiciary of Córdoba

On Aug 13, 2022, Argentina’s Judiciary of Córdoba was targeted by Play Ransomware Group. They shut down Argentina’s Judiciary of Córdoba’s IT systems, databases, and online portals. Then they encrypted their files with “.play” extensions. After that, they left a simple ReadMe.txt to contact them.

What are the Security Recommendations?

Play Ransomware attacks emphasize the evolution of cyber threats. Recently, threat actors implement advanced evasion techniques to avoid detection by security tools. Therefore, you should deploy more security components like CTI platforms to get in intelligence about new threats from the dark web and learn about a specific threat against your company. Additionally, some curated mitigation steps are below.

Employ MFA (multifactor authentication) for all possible services to prevent attackers’ lateral movements.
Apply the least privilege principle, especially to critical systems and services.
Enable logical and physical network segmentation for separation of different units’ accesses.
Deploy attack surface management (ASM), assisting in understanding cyber assets.
Secure domain controllers (DC) using best practices.
Maintain offline and encrypted backups of data, especially the 3-2-1 backup rule for essential files.
Track security patches and software/OS updates regularly.