Ransomware needs a way in. Stolen credentials are the cheapest one.
play Ransomware Group
Ransomware group profile
283Victims
RussiaSource country
131Impact score
Also Known As
play ransomware
Play
PlayCrypt
Description
Play Ransomware is a rapidly emerging ransomware group known for its targeted attacks on sectors like healthcare, education, and finance. The group distinguishes itself by employing both innovative techniques and traditional tactics, focusing on organizations with perceived weak cybersecurity defenses.
Key insights
- •Utilizes a double extortion model, encrypting data and exfiltrating sensitive information with threats of public release.
- •Targets sectors like healthcare, education, and finance, exploiting vulnerabilities in their systems.
- •Engages in sophisticated spear-phishing campaigns to gain initial access.
Threat Level & Status Breakdown
For play · Based on incidents in selected period
1.9threat level
Aggressiveness5/ 10
Lethality0/ 10
Criticality0.4/ 10
Status Breakdown
Claimed100.0%283
First seenAug 2025
Last seenJul 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedAug 27, 2026
Recent activity
Monthly attack count for play in the selected period
283Total attacks
46peak in Feb
23.6avg / month
↑ 10 vs first month
Intelligence
IOCs, YARA/Sigma rules, and related families for play
- 8ebddd79bb7ef1b9fcbc1651193b002bfef598fd
- fd6c16a31f96e0fd65db5360a8b5c179a32e3b8e
- 4508d0254431df5a59692d7427537df8a424dbba
- 7e8aeba19d804b8f2e7bffa7c6e4916cf3dbee62
- c198971f84a74e972142c6203761b81f8f854d2c
- 6cf281fc9795d5e94054cfe222994209779d0ba6
- cc9cd337b28752b8ba1f41f773a3eac1876d8233
- 5ed4d42d0dcc929b7f1d29484b713b3b2dee88e3
- 8abd64e0c4515d27fae4de74841e66cfc4371575
- 3affa67bc7789fd349f8a6c9e28fa1f0c453651f
- fadd8a6c816bebe3924e0b4542549f55c5283db8
- 4589b97225ba3e4a4f382540318fa8ce724132d5
- 1e5920a6b79a93b1fa8daca32e13d1872da208ee
- 783cd767b496577038edbe926d008166ebe1ba8c
- 79e41b93b540f6747d0d2c3a22fd45ab0eac09ab
- 65300576ba66f199fca182c7002cb6701106f91c
- d94448afd4841981b1b49ecf63db3b63cb208853
- b1e0abfdaa655cf29b44d5848fab253c43d5350a
- 33dba9c156f6ceda40aefa059dea6ef19a767ab2
- 5d3160f01920a6b11e3a23baec1ed9c6d8d37a68
- 0830ef2fe7813ccf6821cad71a22e4384b4d02b4
- de055a89de246e629a8694bde18af2b1605e4b9b493c7e4aef669dd67acf5085
- 14ba3fa927a06224dfe587014299e834def4644f
- 7574cf2c64f35161ab1292e2f532aabf
- 00020cfe58fe9be476347ffb8318f9bcd031aef36ea71b2f5fab95d6507e71fd
- 59ac7dd41dca19a25a78a242e93a7ded
- 57db3bb722a00419191d267dba57a77d011f77c0c74d753172b22d3810f97c69
- accf036232d2570796bf0abf71ffe342dc35e2f07b12041fe739d44a06f36af8
- 937216d5260f3e76138be16831052b04c710e15d91756124d8d6755d2766ff4b
- 7f731cc11f8e4d249142e99a44b9da7a48505ce32c4ee4881041beeddb3760be
- 9585af44c3ff8fd921c713680b0c2b3bbc9d56add848ed62164f7c9b9f23d065
- 0c0e0f9b09b80d87ebc88e2870907b6cacb4cd7703584baf8f2be1fd9438696d
- c9c94ac5e1991a7db42c7973e328fceeb6f163d9f644031bdfd4123c7b3898b0
- 0ee1d284ed663073872012c7bde7fac5ca1121403f1a5d2d5411317df282796c
- 000105e9c8d938ce6eeadbfaf39a69772e1132d1eaae7c6bcbe06a115520a0f3
- f78a870573f5bf2f15570e286257fae7
- eaccbf47cd42836b0e21ab2196b86d98a28733ca
- 356ca8abf11d97bf9dcbff47c04bf1ddcb8685ef84d38e6850ec6c28a37655b9
- 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
- 51ffc0b7358b7611492ef458fdf9b97f121e49e70f86a6b53b93ed923b707a03
- b087e1309f3eab6302d7503079af1ad6af06d70a932f7a6ae1421b942048e28a
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for play
CVE-2025-29824
CVE-2024-57728
CVE-2024-57727
CVE-2024-57726
CVE-2024-40766
CVE-2024-29824
CVE-2024-26169
Other
T1486
T1486
T1490
T1490
T1078
T1078
T1080
T1080
T1021
T1021
T1021.001
T1021.001
T1562
T1562
T1059
T1059
T1547
T1547
T1203
T1203
Victims(200)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Be Media | United States | Claimed | 8 days ago | |
| Latoplast Ltd. | Latvia | Claimed | 8 days ago | |
| Coltrane | United States | Claimed | 10 days ago | |
| Bridgeport Capital | United States | Claimed | 11 days ago | |
| Sam Pack Auto Group | United States | Claimed | 11 days ago | |
| Woodhaven Lakes Association | United States | Claimed | 11 days ago | |
| MIE Solutions | United Kingdom | Claimed | 19 days ago | |
| Rilpa Enterprises | Canada | Claimed | 19 days ago | |
| Marconi Industrial Services S.p.a. | Italy | Claimed | 19 days ago | |
| The DeBruler | — | Claimed | 21 days ago | |
| Signature Services | United States | Claimed | 22 days ago | |
| GCATS Investments | United States | Claimed | 22 days ago | |
| Platinum Group | Singapore | Claimed | 22 days ago | |
| First Tek | Taiwan | Claimed | 24 days ago | |
| Preferred Financial Group | United States | Claimed | 24 days ago | |
| The Butcher Brothers | United States | Claimed | 27 days ago | |
| Sigma Plastics Group | United States | Claimed | 27 days ago | |
| Cambridge Management Inc | United States | Claimed | 27 days ago | |
| Record go Mobility | Argentina | Claimed | about 1 month ago | |
| Restaurant Depot | United States | Claimed | about 1 month ago |
Claimed
21 days agoPage 1 of 10
Affected countries(82)
Countries where this group has been reported to target or leak victims.
🇦🇩Andorra🇦🇪United Arab Emirates🇦🇫Afghanistan🇦🇴Angola🇦🇷Argentina🇦🇹Austria🇦🇺Australia🇧🇩Bangladesh🇧🇪Belgium🇧🇬Bulgaria🇧🇮Burundi🇧🇷Brazil🇧🇸Bahamas🇧🇼Botswana🇨🇦Canada🇨🇭Switzerland🇨🇲Cameroon🇨🇳China🇨🇴Colombia🇨🇺Cuba🇨🇿Czech Republic🇩🇪Germany🇩🇰Denmark🇩🇴Dominican Republic🇩🇿Algeria🇪🇨Ecuador🇪🇸Spain🇫🇮Finland🇫🇷France🇬🇧United KingdomGuernseyGreenland🇬🇷Greece🇭🇳Honduras🇭🇹Haiti🇭🇺Hungary🇮🇩Indonesia🇮🇪Ireland🇮🇱Israel🇮🇳IndiaIran, Islamic Republic of🇮🇹Italy🇯🇲Jamaica🇯🇵Japan🇰🇪KenyaKorea, Republic of🇱🇰Sri Lanka🇱🇷Liberia🇱🇺Luxembourg🇱🇻LatviaMacao🇲🇹Malta🇲🇽Mexico🇲🇿Mozambique🇳🇦Namibia🇳🇬Nigeria🇳🇮Nicaragua🇳🇱Netherlands🇳🇴Norway🇳🇵Nepal🇳🇿New Zealand🇵🇦Panama🇵🇭Philippines🇵🇰Pakistan🇵🇱Poland🇵🇹Portugal🇵🇾ParaguayRussian Federation🇸🇦Saudi Arabia🇸🇪Sweden🇸🇬Singapore🇸🇰Slovakia🇸🇳Senegal🇹🇭Thailand🇹🇷TurkeyTaiwan, Province of China🇺🇦Ukraine🇺🇸United StatesVenezuela, Bolivarian Republic of🇻🇳Vietnam🇿🇦South AfricaGlobal