Play Ransomware Profile: Initial Access, Extortion and Defences

Play is a double extortion ransomware operation that gets in mainly through valid accounts, exposed remote access and unpatched edge systems, then steals data before encrypting Windows and VMware ESXi hosts. The FBI said in its June 2025 update to joint advisory AA23-352A that it was aware of approximately 900 affected entities as of May 2025, up from about 300 as of October 2023. This profile uses that advisory, MITRE ATT&CK, CrowdStrike and Palo Alto Networks Unit 42 to explain how Play operates, where identities and credentials sit in its playbook and what defenders should prioritise. It is for security operations, infrastructure and identity teams, and reflects public reporting as of October 2026, based on sources available.

Key takeaways

• Volume and persistence. Active since June 2022, Play reached roughly 900 known victims across North America, South America and Europe by May 2025, according to the FBI.
• Access starts with credentials and edge flaws. CISA lists valid accounts, RDP and VPN, FortiOS and Exchange vulnerabilities, and from 2025 a SimpleHelp RMM flaw exploited by access brokers tied to Play.
• Each payload is unique. The 2025 update says the binary is recompiled for every attack, so hash-based blocking fails and behaviour-based detection is required.
• Extortion is personal. Ransom notes carry no demand, only a unique email address, and victims regularly receive phone calls pressing for payment, sometimes routed to help desks or customer service lines.
• Hypervisors are in scope. An ESXi variant powers off virtual machines and encrypts their files, so hypervisor management access is a crown jewel.

Who they are (names and aliases)

MITRE ATT&CK tracks the group as Play (G1040) and its ransomware as Playcrypt (S1162). The ransomware takes its name from the .play extension added to encrypted files. MITRE notes overlap with tactics and tools associated with Hive and Nokoyawa ransomware and infrastructure associated with Quantum. Play's leak site describes it as a closed group intended to "guarantee the secrecy of deals", and the joint advisory presumes it is closed rather than a public ransomware-as-a-service programme.

Links to other actors: in October 2024 Unit 42 assessed with moderate confidence that Jumpy Pisces, a North Korean state-sponsored group also tracked as Andariel and Onyx Sleet, collaborated with Play in an intrusion that began in May 2024 with a compromised user account. Unit 42 said it was unclear whether Jumpy Pisces acted as an affiliate or as an initial access broker. In 2025 CISA reported initial access brokers "with ties to Play ransomware operators" exploiting SimpleHelp. Both show that Play's access often comes from someone else, which makes credential and edge hygiene the decisive control. See the Ransomware Groups Guide and the Lazarus Group Threat Actor Profile.

Targeting and motivation

• Motivation: financial. MITRE records ransom demands to decrypt systems and to stop publication of stolen data (T1657).
• Sectors: MITRE lists business, government, critical infrastructure, healthcare and media. The advisory describes a wide range of businesses and critical infrastructure.
• Regions: North America, South America and Europe according to the FBI; the Australian Signals Directorate's ACSC observed its first Australian incident in April 2023.
• Victim profile: organisations with exposed VPN, RDP, Exchange or RMM services and weak account controls, rather than a named industry. Managed service and hosting providers matter because one compromise can reach many customers, as the Rackspace incident showed.

Tactics and techniques (MITRE ATT&CK)

Techniques below come from the ATT&CK v20 entries for G1040 and S1162 and from AA23-352A. All IDs were checked against ATT&CK v20.

Extortion mechanics: the note (ReadMe.txt, placed in C:\) contains no demand or payment instructions, only an email address that the 2025 update says is unique per victim at gmx.de or web.de. Payment is in cryptocurrency, with a threat to publish data on a Tor leak site. The ESXi variant also sets the ESXi welcome message to the ransom note. See the Ransomware Negotiation Guide and the Ransomware Payments and Sanctions Guide.

How they abuse identities and credentials

• VPN accounts without strong MFA: the advisory's first listed access route is valid accounts, and its first identity mitigation is MFA on webmail, VPN and critical systems (CPG 2.H). FortiOS CVE-2020-12812 is itself an authentication flaw that, in affected configurations, allowed login without the second factor. See the VPN Security Guide.
• Exchange and authenticated exploits: CrowdStrike found that Play intrusions in late 2022 used OWASSRF, chaining CVE-2022-41080 and CVE-2022-41082 through Outlook Web Access to reach remote PowerShell, bypassing the URL rewrite mitigations published for ProxyNotShell. Exchange exploitation of this kind generally starts from a valid mailbox credential.
• RMM as a machine identity: SimpleHelp servers hold privileged, trusted access to every managed endpoint. Exploiting one hands an attacker that trust. See the RMM Tool Security Guide.
• Directory mapping then credential theft: BloodHound and AdFind show the shortest path to domain admin; Mimikatz then harvests the credentials on that path. See the Credential Dumping Guide.
• Admin rights as a distribution system: once domain admin is reached, Group Policy and PsExec push tools and the payload everywhere at once. Tiered admin and just-in-time access, both recommended in the advisory, limit this. See the Tiered Administration and Enterprise Access Model Guide.
• Help desk as an extortion channel: the 2025 update notes calls routed to help desks and customer service. Brief those teams on escalation so a caller cannot extract information or pressure staff.

Notable incidents

Detection and defence

Controls mapped to Play techniques

What to monitor

• Edge and RMM logs: VPN logins from new countries or hosting providers, logins at odd hours, and new sessions or admin accounts on SimpleHelp or other RMM servers.
• Exchange: IIS logs and Remote PowerShell logs, which CrowdStrike recommends reviewing, plus EDR alerts for IIS worker processes spawning PowerShell or cmd.exe.
• Discovery bursts: AdFind, Nltest or BloodHound collection from a non-admin workstation, and large LDAP query volumes.
• Credential theft: handle access to lsass.exe by non-system processes, including Task Manager creating a dump.
• Defence tampering: Defender disabled through PowerShell, driver-based tools such as GMER or PowerTool loading, and Event ID 1102 (security log cleared).
• Mass change: new GPOs that copy or run executables, PsExec service creation across many hosts, and ESXi hosts powering off many VMs at once.

Metrics that show it is working

• Percentage of VPN, RDP gateway and RMM accounts on phishing-resistant MFA (target: 100).
• Median days to patch KEV entries on edge devices and RMM servers.
• Number of accounts with domain admin rights and number used interactively on workstations.
• Percentage of hosts reporting EDR with tamper protection on, checked weekly.
• Time to restore a representative ESXi workload from immutable backup in the last test.

Common failure patterns

• Relying on mitigations instead of patches: the ProxyNotShell URL rewrite rules did not stop OWASSRF, and Rackspace's hosted Exchange was hit in December 2022.
• Hash-based blocking: a binary recompiled for every attack makes IOC hash lists of little preventive value. Use them for scoping, not prevention.
• Unmanaged RMM servers: a self-hosted remote support server outside the patch cycle gives access brokers a ready-made route to every endpoint it manages.
• Backups reachable with domain credentials: once Play holds domain admin, joined backup servers and hypervisor consoles fall too. See the Backup Security and Immutable Backup Guide.
• Dormant VPN accounts: unused accounts with a single factor are a recurring ransomware entry point, as the Colonial Pipeline ransomware attack showed with a different ransomware group.

Practitioner checklist

• Check FortiOS, Exchange and SimpleHelp versions against the CVEs in AA23-352A and patch or isolate today.
• Enforce phishing-resistant MFA on VPN, webmail and RMM, and disable remote access accounts unused for 30 days. See the Phishing-Resistant MFA Guide.
• Audit Active Directory for unrecognised and over-privileged accounts and move admins to just-in-time access.
• Deploy LAPS and LSA protection, and keep domain admin credentials off workstations.
• Turn on EDR tamper protection and forward Windows security, PowerShell and ESXi logs off-host.
• Restrict ESXi management to a dedicated admin network with separate credentials. See the Hypervisor and Virtualisation Security Guide.
• Keep immutable, offline backups and test restoring ESXi workloads.
• Brief the help desk and customer service on extortion calls and escalation.
• Test controls against the ATT&CK techniques in the advisory, as CISA recommends.

Standards and references

• CISA, FBI and ASD's ACSC: #StopRansomware: Play Ransomware (AA23-352A)
• FBI IC3: #StopRansomware: Play Ransomware, updated advisory
• MITRE ATT&CK: Play (G1040)
• MITRE ATT&CK: Playcrypt (S1162)
• CISA: Known Exploited Vulnerabilities Catalog
• CrowdStrike: OWASSRF exploit analysis and recommendations
• Palo Alto Networks Unit 42: Jumpy Pisces engages in Play ransomware
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Ransomware Groups Guide · Ransomware Prevention Guide · Ransomware Response and Recovery Guide · Top 10 Ransomware Initial Access Vectors