Ransomware Intelligence

Latest Research on INC and The Gentlemen Ransomware: Exposed AI Infrastructure

Read the Research

Play Ransomware Ransomware Group

Ransomware group profile

263Victims
RussiaSource country
131Impact score
Also Known As
play ransomware
Play
PlayCrypt

Description

Play Ransomware is a rapidly emerging ransomware group known for its targeted attacks on sectors like healthcare, education, and finance. The group distinguishes itself by employing both innovative techniques and traditional tactics, focusing on organizations with perceived weak cybersecurity defenses.

Key insights

  • •Utilizes a double extortion model, encrypting data and exfiltrating sensitive information with threats of public release.
  • •Targets sectors like healthcare, education, and finance, exploiting vulnerabilities in their systems.
  • •Engages in sophisticated spear-phishing campaigns to gain initial access.

Industries

EducationEnergy & UtilitiesFinancial ServicesGovernment & DefenseHealthcareHospitalityManufacturingOtherProfessional ServicesRetail & E-CommerceTechnologyTransportation

Threat Level & Status Breakdown

For Play Ransomware · Based on incidents in selected period

No victim data for this group in the selected period.

First seenOct 2025
Last seenOct 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedOct 27, 2026

Recent activity

Monthly attack count for Play Ransomware in the selected period

263Total attacks
46peak in Feb
20.2avg / month
↑ 11 vs first month
OctNovDecJanFebMarAprMayJunJulAugSepOct015304560

Intelligence

IOCs, YARA/Sigma rules, and related families for Play Ransomware

  1. 8ebddd79bb7ef1b9fcbc1651193b002bfef598fd
  2. fd6c16a31f96e0fd65db5360a8b5c179a32e3b8e
  3. 4508d0254431df5a59692d7427537df8a424dbba
  4. 7e8aeba19d804b8f2e7bffa7c6e4916cf3dbee62
  5. c198971f84a74e972142c6203761b81f8f854d2c
  6. 3affa67bc7789fd349f8a6c9e28fa1f0c453651f
  7. fadd8a6c816bebe3924e0b4542549f55c5283db8
  8. 4589b97225ba3e4a4f382540318fa8ce724132d5
  9. 1e5920a6b79a93b1fa8daca32e13d1872da208ee
  10. 783cd767b496577038edbe926d008166ebe1ba8c
  11. 79e41b93b540f6747d0d2c3a22fd45ab0eac09ab
  12. 65300576ba66f199fca182c7002cb6701106f91c
  13. d94448afd4841981b1b49ecf63db3b63cb208853
  14. b1e0abfdaa655cf29b44d5848fab253c43d5350a
  15. 33dba9c156f6ceda40aefa059dea6ef19a767ab2
  16. 5d3160f01920a6b11e3a23baec1ed9c6d8d37a68
  17. de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
  18. 14ba3fa927a06224dfe587014299e834def4644f
  19. 7574cf2c64f35161ab1292e2f532aabf
  20. 57db3bb722a00419191d267dba57a77d011f77c0c74d753172b22d3810f97c69
  21. accf036232d2570796bf0abf71ffe342dc35e2f07b12041fe739d44a06f36af8
  22. 937216d5260f3e76138be16831052b04c710e15d91756124d8d6755d2766ff4b
  23. 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be
  24. 0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d
  25. c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
  26. 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
  27. 4f1051781225dbc7970878c28ff18ad0
  28. 43bf593fad28867609dc757e4870e4800d204a10
  29. a9ad9ef62d1ff9444e0d87ded0cc6d0c
  30. 15358d993684a86912a78b256481458213c41321
  31. 000105e9c8d938ce6eeadbfaf39a69772e1132d1eaae7c6bcbe06a115520a0f3
  32. f78a870573f5bf2f15570e286257fae7
  33. eaccbf47cd42836b0e21ab2196b86d98a28733ca
  34. 356ca8abf11d97bf9dcbff47c04bf1ddcb8685ef84d38e6850ec6c28a37655b9
  35. b087e1309f3eab6302d7503079af1ad6af06d70a932f7a6ae1421b942048e28a
  36. f84da76ddaf196d12a600f6f4ddda2e2
  37. 4398670073785d6569ca16b371cac2cdd9007ab3
  38. 000354e64e175f3f7712448e6b192a5f674e9276c2cc0d42724b5bb6ba8bd8a2
View full IOC feed500 total

TTPs & Attack Vectors

Tools, initial access, and MITRE ATT&CK techniques for Play Ransomware

CVE-2025-29824
CVE-2024-57728
CVE-2024-57727
CVE-2024-57726
CVE-2024-40766
CVE-2024-29824
CVE-2024-26169
Other

T1486

T1486

T1490

T1490

T1078

T1078

T1080

T1080

T1021

T1021

T1021.001

T1021.001

T1562

T1562

T1059

T1059

T1547

T1547

T1203

T1203

Affected countries(85)

Countries where this group has been reported to target or leak victims.

🇦🇩Andorra🇦🇪United Arab Emirates🇦🇫Afghanistan🇦🇴Angola🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇩Bangladesh🇧🇪Belgium🇧🇬Bulgaria🇧🇮Burundi🇧🇷Brazil🇧🇸Bahamas🇧🇼Botswana🇨🇦Canada🇨🇭Switzerland🇨🇲Cameroon🇨🇳China🇨🇴Colombia🇨🇺Cuba🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇩🇿Algeria🇪🇨Ecuador🇪🇸Spain🇫🇮Finland🇫🇷France🇬🇧United KingdomGuernseyGreenland🇬🇷Greece🇭🇳Honduras🇭🇹Haiti🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳IndiaIran, Islamic Republic of🇮🇹Italy🇯🇲Jamaica🇯🇵Japan🇰🇪KenyaKorea, Republic of🇱🇰Sri Lanka🇱🇷Liberia🇱🇺Luxembourg🇱🇻Latvia🇲🇳MongoliaMacao🇲🇹Malta🇲🇽Mexico🇲🇿Mozambique🇳🇦Namibia🇳🇬Nigeria🇳🇮Nicaragua🇳🇱Netherlands🇳🇴Norway🇳🇵Nepal🇳🇿New Zealand🇵🇦Panama🇵🇭Philippines🇵🇰Pakistan🇵🇱Poland🇵🇹Portugal🇵🇾Paraguay🇷🇸SerbiaRussian Federation🇸🇦Saudi Arabia🇸🇪Sweden🇸🇬Singapore🇸🇰Slovakia🇸🇳Senegal🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇦Ukraine🇺🇸United States🇺🇾UruguayVenezuela, Bolivarian Republic of🇻🇳Vietnam🇿🇦South AfricaGlobal