play
ransomware group · aka Play, PlayCrypt, Water Curupira Pikapilya (Trend Micro tracking name) · unknown; widely assessed as likely Russia-based, though no confirmed attribution · active since 2022
Play (PlayCrypt) is a double-extortion ransomware group first publicly documented in 2022, known for a leak-first extortion model, distinctive ransom notes that omit ransom amounts and contact details, and encryption support for Windows, Linux, and FreeBSD. Victim sectors reported include government facilities, critical infrastructure, education facilities, information technology, healthcare/public health, financial services, and manufacturing, across North America, South America, and Europe. Per the FBI/CISA #StopRansomware advisory update (December 2024), Play had affected approximately 900 organizations worldwide, up from about 300 as of July 2023. The group gains access by exploiting known vulnerabilities in internet-facing appliances and remote-monitoring/management (RMM) software, supplemented by valid-account use. Dashboard tracking: 2 victims in the last 7/30/90 days, 2 total since 2026-09-09; last post 2026-09-09.
- Exploits known vulnerabilities in Fortinet devices for initial access (CVE-2018-13379, CVE-2020-12812, CVE-2020-15310) per FBI/CISA advisory (2024 update)
- Exploited SimpleHelp RMM path-traversal flaw CVE-2024-5776 as an access vector per FBI/CISA advisory (January 2025)
- Uses valid accounts, RDP, and RMM/remote-access tooling for lateral movement and persistence
- Living-off-the-land operations: GPO and scheduled-task deployment, disabling Microsoft Defender, use of batch/PowerShell tooling (FBI/CISA, 2023)
- Exfiltrates victim data before encryption; reported use of rsync for data transfer
- Double extortion via Tor-based 'Play News' leak site; ransom notes characteristically lack ransom amount and initial contact information
- Encrypts across Windows, Linux, and FreeBSD systems
Dallas County, Texas (2023; attribution via widely reported press coverage), Red Star Oil (leak-site post tracked by this dashboard, posted 2026-09-09), GT Distributors (leak-site post tracked by this dashboard, posted 2026-09-09)
No public figure.
Leak-site victims1,282 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Diverse Technology Industrial | · Jun 12, 2024 | — |
| Air Cleaning Specialists | · Jun 12, 2024 | — |
| Corbin Turf & Ornamental Supply | · Jun 12, 2024 | — |
| Kinter | · Jun 12, 2024 | — |
| Elmhurst Group | · May 30, 2024 | — |
| WALSER AUTOMOTIVE GROUP | · May 30, 2024 | — |
| FPL Food | · May 30, 2024 | — |
| Credit Central | · May 30, 2024 | — |
| Ntv | · May 30, 2024 | — |
| Ryder Scott Co. | · May 22, 2024 | — |
| Tri-state General Contractors | · May 22, 2024 | — |
| Starostwo Powiatowe w Świebodzinie | · May 22, 2024 | — |
| Aspire Tax | · May 22, 2024 | — |
| The Louis G Freeman | · May 22, 2024 | — |
| Experis Technology Group | · May 22, 2024 | — |
| Anchorage Daily News | · May 22, 2024 | — |
| RDI-USA | · May 22, 2024 | — |
| Ardenbrook | · May 22, 2024 | — |
| Visa Lighting | · May 22, 2024 | — |
| Semicore Equipment | · May 22, 2024 | — |
| Levin Porter Associates | · May 22, 2024 | — |
| LiveHelpNow | · May 10, 2024 | — |
| NK Parts Industries | · May 10, 2024 | — |
| Badger Tag & Label | · May 10, 2024 | — |
| Haumiller Engineering | · May 10, 2024 | — |
| Central Florida Equipment | · May 7, 2024 | — |
| High Performance Services | · May 7, 2024 | — |
| Mauritzon | · May 7, 2024 | — |
| Somerville | · May 7, 2024 | — |
| Donco Air | · May 7, 2024 | — |
| Affordable Payroll & Bookkeeping Services | · May 7, 2024 | — |
| Utica Mack | · May 7, 2024 | — |
| KC Scout | · May 7, 2024 | — |
| Sentry Data Management | · May 7, 2024 | — |
| Stainless Foundry & Engineering | · May 3, 2024 | — |
| Canatal Industries | · May 2, 2024 | — |
| Advanced Business Networks | · Apr 30, 2024 | — |
| Profile Products | · Apr 30, 2024 | — |
| C?????l I????????s | · Apr 30, 2024 | — |
| Axip Energy Services | · Apr 26, 2024 | — |
| Original Herkimer Cheese | · Apr 26, 2024 | — |
| Precision Fluid Controls | · Apr 26, 2024 | — |
| Yale Mortgage | · Apr 26, 2024 | — |
| Madata | · Apr 26, 2024 | — |
| Legislative Bill Drafting Commission | · Apr 26, 2024 | — |
| Toolmarts | · Apr 26, 2024 | — |
| New Hudson Facades | · Apr 26, 2024 | — |
| Alltruck Bodies | · Apr 19, 2024 | — |
| SIS Automatisering | · Apr 19, 2024 | — |
| Pennsylvania Convention Center | · Apr 19, 2024 | — |
In the newsAll →
No articles mention this group yet.