play
1,335 victims claimedFirst seen Nov 26, 2022Last post 19m ago4 known sites
No consistent public attribution to a single nation
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs
Targeted sectors
- Manufacturing353
- Professional Services305
- Technology171
- Retail & E-Commerce98
- Transportation73
- Agriculture and Food Production66
- Financial Services49
- Hospitality46
Targeted countries
- United States947
- Canada98
- United Kingdom42
- Germany41
- Netherlands17
- Sweden15
- Switzerland10
- Australia9
Tactics and techniques (MITRE ATT&CK)
- Initial Access
- T1078 · Valid AccountsT1078.002 · Valid Accounts: Domain AccountsT1078.003 · Valid Accounts: Local AccountsT1133 · External Remote ServicesT1190 · Exploit Public-Facing Application
- Execution
- T1053.005 · Scheduled Task/Job: Scheduled TaskT1059 · Command and Scripting InterpreterT1059.001 · Command and Scripting Interpreter: PowerShellT1059.003 · Command and Scripting Interpreter: Windows Command Shell
- Persistence
- T1078.002 · Valid Accounts: Domain AccountsT1078.003 · Valid Accounts: Local AccountsT1133 · External Remote Services
- Privilege Escalation
- T1078.002 · Valid Accounts: Domain AccountsT1078.003 · Valid Accounts: Local Accounts
- Defense Evasion
- T1027 · Obfuscated Files or InformationT1070 · Indicator RemovalT1070.001 · Indicator Removal: Clear Windows Event LogsT1484 · Domain or Tenant Policy ModificationT1484.001 · Domain or Tenant Policy Modification: Group Policy ModificationT1562.001 · Disable or Modify Tools
- Stealth
- T1027.010 · Obfuscated Files or Information: Command ObfuscationT1070.004 · Indicator Removal: File DeletionT1078.002 · Valid Accounts: Domain AccountsT1078.003 · Valid Accounts: Local Accounts
- Credential Access
- T1003 · OS Credential DumpingT1003.001 · OS Credential Dumping: LSASS MemoryT1003.003 · OS Credential Dumping: NTDST1552 · Unsecured Credentials
- Discovery
- T1016 · System Network Configuration DiscoveryT1018 · Remote System DiscoveryT1046 · Network Service DiscoveryT1057 · Process DiscoveryT1082 · System Information DiscoveryT1083 · File and Directory DiscoveryT1087.002 · Account Discovery: Domain AccountT1518 · Software DiscoveryT1518.001 · Software Discovery: Security Software Discovery
- Lateral Movement
- T1021.001 · Remote Services: Remote Desktop ProtocolT1021.002 · Remote Services: SMB/Windows Admin SharesT1570 · Lateral Tool Transfer
- Command and Control
- T1105 · Ingress Tool TransferT1219 · Remote Access Software
- Impact
- T1486 · Data Encrypted for ImpactT1489 · Service StopT1490 · Inhibit System RecoveryT1657 · Financial Theft
- Resource Development
- T1587.001 · Develop Capabilities: MalwareT1588.002 · Obtain Capabilities: Tool
Tools observed
- Credential Theft
- HandleKatz, Mimikatz, Nanodump
- Defense Evasion
- EDRKill (echo_driver.sys + DBUtil 2.3), GMER, IOBit, PowerTool, icardagt.exe (version.dll DLL sideload)
- Discovery Enum
- AdFind, WKTools
- Exfiltration
- WinSCP
- LOLBAS
- PsExec
- Networking
- FRP, Plink
- Offsec
- Cobalt Strike, WinPEAS
Most recent victims
- MicroSearchTechnology19m ago
- QLCTechnology · Germany19m ago
- WSBI-ESBGFinancial Services · Belgium10d ago
- New Tec Tool LimitedManufacturing · Hong Kong10d ago
- MicroSearch CorporationTechnology10d ago
- Pure OptionsFinancial Services10d ago
- The Innovation GroupOther · United States14d ago
- DFK GroupProfessional Services · Germany14d ago
- Saddlers Court MFGManufacturing · United Kingdom14d ago
- Culinary SpecialtiesAgriculture and Food Production · United States14d ago
- Advanced Imaging SolutionsTechnology · Mongolia14d ago
- Bold Spring NurseryAgriculture and Food Production · United States22d ago
- Silicon Valley GlassManufacturing · United States22d ago
- TitusTechnology · Germany27d ago
- Airtech Mechanical ServicesProfessional Services · United States27d ago
- Orth AutomobileManufacturing · Germany27d ago
- Starr Whitehouse Landscape ArchitectsProfessional Services · United States28d ago
- Ever Ready First AidHealthcare · United States28d ago
- MetallcoManufacturing · Brazil35d ago
- HurleyOther · United States35d ago
- Vista Plastic SolutionsManufacturing · Canada38d ago
- Inglewood GolfHospitality · Canada38d ago
- Barrett Mahony Consulting EngineersProfessional Services · Ireland38d ago
- Sys-koolTechnology46d ago
- Grunthal Welding & SuppliesManufacturing · Canada46d ago
- Red Star OilEnergy & Utilities · Serbia48d ago
- GT DistributorsRetail & E-Commerce · United States48d ago
- MEQCanada57d ago
- Figgins Family Wine EstatesAgriculture and Food Production · United States57d ago
- KRC Machine Tool SolutionsManufacturing · United States57d ago
- Meteor GroupOther · Germany57d ago
- Be MediaTechnology · United States68d ago
- LatoplastManufacturing · Latvia68d ago
- Coltrane SystemsTechnology · United States70d ago
- Bridgeport Capital ServicesFinancial Services · United States70d ago
- Sam Pack Auto GroupRetail & E-Commerce · United States70d ago
- Woodhaven AssociationOther · United States70d ago
- MIE SolutionsProfessional Services · United Kingdom78d ago
- Rilpa Enterprises78d ago
- Marconi Industrial ServicesManufacturing · Italy78d ago