play
ransomware group · aka Play, Playcrypt · unknown; treated in public reporting as a closed cybercriminal operation, with some vendors noting Russian-language elements but no official government attribution · active since June 2022
- Victims · 7d7+7 vs prior week
- Victims · 30d18
- Victims · 90d50
- All-time (tracked)1.3Ksince 2022-11-26
- Last post10-27 19:25UTC
- Estimated earnings—public reporting
Play (also called Playcrypt) is a double-extortion ransomware operation first observed in June 2022 that encrypts systems and threatens to publish stolen data. Operators have used exploitation of known flaws in public-facing services, including Fortinet SSL VPN and Microsoft Exchange, as well as compromised valid accounts, followed by commodity and custom tools for discovery, credential access, and lateral movement. The group uses intermittent encryption, the .play extension, and email-based negotiation, and has generally operated as a closed crew rather than a classic open ransomware-as-a-service program. A December 2023 FBI, CISA, and ACSC advisory said Play had hit roughly 300 organizations across North America, South America, and Europe, including government and other critical infrastructure. Leak-site tracking on this dashboard still shows new listings through 4 October 2026, so the operation is assessed as active.
- Initial access via exploited public-facing applications and VPN or remote-access flaws
- Use of compromised valid accounts and remote desktop access
- Double extortion: data theft before encryption, with threatened publication
- Intermittent encryption and files marked with the .play extension
- Commodity and custom tooling reported publicly, including Cobalt Strike, SystemBC, Mimikatz, AdFind, PsExec, and Grixba
- Living-off-the-land techniques, security-tool tampering, and log clearing
- Email negotiation rather than an upfront payment amount in the ransom note
- Broad targeting of organizations in multiple countries rather than a single sector
City of Oakland, Rackspace
No public figure.
Leak-site victims
1,310 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| Tailormade Logistics | · 5d ago | — |
| Coast 2 Coast | · 5d ago | — |
| VPC Builders | · 5d ago | — |
| Hygiena | · 5d ago | — |
| Money Concepts Capital | · 5d ago | — |
| MicroSearch | · 5d ago | — |
| QLC | · 5d ago | — |
| WSBI-ESBG | · 15d ago | — |
| New Tec Tool Limited | · 15d ago | — |
| MicroSearch Corporation | · 15d ago | — |
| Pure Options | · 15d ago | — |
| The Innovation Group | · 19d ago | — |
| DFK Group | · 19d ago | — |
| Saddlers Court MFG | · 19d ago | — |
| Culinary Specialties | · 19d ago | — |
| Advanced Imaging Solutions | · 19d ago | — |
| Bold Spring Nursery | · 27d ago | — |
| Silicon Valley Glass | · 27d ago | — |
| Titus | · Sep 30, 2026 | — |
| Airtech Mechanical Services | · Sep 30, 2026 | — |
| Orth Automobile | · Sep 30, 2026 | — |
| Starr Whitehouse Landscape Architects | · Sep 28, 2026 | — |
| Ever Ready First Aid | · Sep 28, 2026 | — |
| Metallco | · Sep 21, 2026 | — |
| Hurley | · Sep 21, 2026 | — |
| Vista Plastic Solutions | · Sep 18, 2026 | — |
| Inglewood Golf | · Sep 18, 2026 | — |
| Barrett Mahony Consulting Engineers | · Sep 18, 2026 | — |
| Sys-kool | · Sep 10, 2026 | — |
| Grunthal Welding & Supplies | · Sep 10, 2026 | — |
| Red Star Oil | · Sep 9, 2026 | — |
| GT Distributors | · Sep 9, 2026 | — |
| MEQ | · Aug 31, 2026 | — |
| Figgins Family Wine Estates | · Aug 31, 2026 | — |
| KRC Machine Tool Solutions | · Aug 31, 2026 | — |
| Meteor Group | · Aug 31, 2026 | — |
| Be Media | · Aug 20, 2026 | — |
| Latoplast | · Aug 20, 2026 | — |
| Coltrane Systems | · Aug 18, 2026 | — |
| Bridgeport Capital Services | · Aug 17, 2026 | — |
| Sam Pack Auto Group | · Aug 17, 2026 | — |
| Woodhaven Association | · Aug 17, 2026 | — |
| MIE Solutions | · Aug 9, 2026 | — |
| Rilpa Enterprises | · Aug 9, 2026 | — |
| Marconi Industrial Services | · Aug 9, 2026 | — |
| Signature Services | · Aug 6, 2026 | — |
| GCATS Investments | · Aug 6, 2026 | — |
| Platinum Group | · Aug 6, 2026 | — |
| First Tek | · Aug 5, 2026 | — |
| Preferred Financial Group | · Aug 5, 2026 | — |
In the news
AllNo articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .