Play

Play, also known as Playcrypt, has hit a wide range of businesses and critical infrastructure in North America, South America and Europe since June 2022, according to the FBI, CISA and the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC). The advisory was first published on December 18, 2023 and revised 4 June 2025 with new tactics and current indicators.

Scale

The advisory says Play was among the most active ransomware groups in 2024. As of May 2025, the FBI was aware of approximately 900 affected entities allegedly exploited by the actors. In Australia, the first incident was seen in April 2023 and the most recent in November 2023.

Tools named in the advisory

The advisory lists AdFind and Grixba for network discovery, GMER, IOBit and PowerTool for switching off defenses, Mimikatz for credentials, WinPEAS for privilege escalation paths, Cobalt Strike and SystemBC for command and control, and PsExec for lateral movement. Mimikatz was used to gain domain administrator access, and the ransomware is distributed through Group Policy Objects. Data is compressed with WinRAR and sent out with WinSCP.

Encryption details

The advisory describes AES-RSA hybrid encryption that encrypts every other portion of each file. MITRE ATT&CK gives the chunk size as 0x100000 bytes, says Playcrypt skips files with .PLAY, .exe, .msi, .dll, .lnk or .sys extensions, and says it can delete shadow copies. The note is named ReadMe.txt and is placed in C:/Users/Public/Music/.

How the group works

The advisory presumes Play is a closed group, and cites a statement on its own leak site that it aims to guarantee the secrecy of deals. Initial access comes from valid accounts that were likely bought on the dark web, from exposed Remote Desktop Protocol (RDP) and VPN services, and from known flaws in FortiOS and Microsoft Exchange.

Inside the network, actors use common tools to query Active Directory, switch off antivirus, steal passwords and move sideways. The ransomware program is recompiled for every attack, so each one has a different file fingerprint, which makes detection harder. Encryption is intermittent: it scrambles alternating chunks of each file, which speeds the process. Encrypted files get a .PLAY extension.

Extortion style

Each victim gets a unique email address ending in gmx.de or web.de. A portion of victims are also called by phone, and the calls can reach help desks or customer service staff. If the victim does not pay, the data is threatened with release on the group’s Tor leak site.

Double extortion: data is stolen, then systems are encrypted. Notes carry no demand, only an email address. Victims who refuse are threatened with publication on a Tor leak site, and some are phoned.