Ransomware.live: play

| Active

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.

On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs

Victims

1287

First Discovered

2022-11-26

victim

Last Discovered

2026-07-23

victim

Inactive Since

days

Avg Delay

43.4

days

Infostealer

31.2%

victims with domain

Countries

hit

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months

+18% vs last month

Known Locations (3)

Title	Available	Last Visit	Server Info	FQDN
PLAY NEWS	No	2026-06-08T22:13:43		`mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion`
PLAY NEWS	No	2026-06-08T22:13:55		`k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion`
PLAY NEWS	No	2026-07-28T01:07:39	nginx	`j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion`

Target

Heatmap

Ransom Notes (3)

Tools Used

This information is provided by Ransomware-Tool-Matrix
Discovery	RMM Tools	Defense Evasion	Credential Theft	OffSec	Networking	LOLBAS	Exfiltration
AdFind WKTools placeholder placeholder placeholder	placeholder placeholder placeholder placeholder placeholder	EDRKill (echo_driver.sys + DBUtil 2.3) GMER IOBit PowerTool icardagt.exe (version.dll DLL sideload)	HandleKatz Mimikatz Nanodump placeholder placeholder	Cobalt Strike WinPEAS placeholder placeholder placeholder	FRP Plink placeholder placeholder placeholder	PsExec placeholder placeholder placeholder placeholder	WinSCP placeholder placeholder placeholder placeholder

TTPs Matrix (15)

This information is provided by Crocodyli & Ransomware.live
Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Stealth	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Impact	Resource Development	Defense Impairment
Valid Accounts	Scheduled Task/Job: Scheduled Task	Valid Accounts: Domain Accounts	Valid Accounts: Domain Accounts	Obfuscated Files or Information	Obfuscated Files or Information: Command Obfuscation	OS Credential Dumping	System Network Configuration Discovery	Remote Services: Remote Desktop Protocol	Archive Collected Data	Data Transfer Size Limits	Ingress Tool Transfer	Data Encrypted for Impact	Develop Capabilities: Malware	Disable or Modify Tools
Valid Accounts: Domain Accounts	Command and Scripting Interpreter	Valid Accounts: Local Accounts	Valid Accounts: Local Accounts	Indicator Removal	Indicator Removal: File Deletion	OS Credential Dumping: LSASS Memory	Remote System Discovery	Remote Services: SMB/Windows Admin Shares	Archive Collected Data: Archive via Utility	Exfiltration Over Alternative Protocol	Remote Access Software	Service Stop	Obtain Capabilities: Tool	Disable or Modify Tools: Clear Windows Event Logs
Valid Accounts: Local Accounts	Command and Scripting Interpreter: PowerShell	External Remote Services		Indicator Removal: Clear Windows Event Logs	Valid Accounts: Domain Accounts	OS Credential Dumping: NTDS	Network Service Discovery	Lateral Tool Transfer				Inhibit System Recovery
External Remote Services	Command and Scripting Interpreter: Windows Command Shell			Domain or Tenant Policy Modification	Valid Accounts: Local Accounts	Unsecured Credentials	Process Discovery					Financial Theft
Exploit Public-Facing Application				Domain or Tenant Policy Modification: Group Policy Modification			System Information Discovery
				Disable or Modify Tools			File and Directory Discovery
							Account Discovery: Domain Account
							Software Discovery
							Software Discovery: Security Software Discovery

KQL Query (2)

YARA Rules (1)

Indicators of Compromise (IoCs) (3)

Email 3

Type	IOC
`Email`	`derdiarikucisv@gmx.de`
`Email`	`raniyumiamrm@gmx.de`
`Email`	`teilightomemaucd@gmx.com`