play
ransomware group · aka Play, PlayCrypt, Water Curupira Pikapilya (Trend Micro tracking name) · unknown; widely assessed as likely Russia-based, though no confirmed attribution · active since 2022
Play (PlayCrypt) is a double-extortion ransomware group first publicly documented in 2022, known for a leak-first extortion model, distinctive ransom notes that omit ransom amounts and contact details, and encryption support for Windows, Linux, and FreeBSD. Victim sectors reported include government facilities, critical infrastructure, education facilities, information technology, healthcare/public health, financial services, and manufacturing, across North America, South America, and Europe. Per the FBI/CISA #StopRansomware advisory update (December 2024), Play had affected approximately 900 organizations worldwide, up from about 300 as of July 2023. The group gains access by exploiting known vulnerabilities in internet-facing appliances and remote-monitoring/management (RMM) software, supplemented by valid-account use. Dashboard tracking: 2 victims in the last 7/30/90 days, 2 total since 2026-09-09; last post 2026-09-09.
- Exploits known vulnerabilities in Fortinet devices for initial access (CVE-2018-13379, CVE-2020-12812, CVE-2020-15310) per FBI/CISA advisory (2024 update)
- Exploited SimpleHelp RMM path-traversal flaw CVE-2024-5776 as an access vector per FBI/CISA advisory (January 2025)
- Uses valid accounts, RDP, and RMM/remote-access tooling for lateral movement and persistence
- Living-off-the-land operations: GPO and scheduled-task deployment, disabling Microsoft Defender, use of batch/PowerShell tooling (FBI/CISA, 2023)
- Exfiltrates victim data before encryption; reported use of rsync for data transfer
- Double extortion via Tor-based 'Play News' leak site; ransom notes characteristically lack ransom amount and initial contact information
- Encrypts across Windows, Linux, and FreeBSD systems
Dallas County, Texas (2023; attribution via widely reported press coverage), Red Star Oil (leak-site post tracked by this dashboard, posted 2026-09-09), GT Distributors (leak-site post tracked by this dashboard, posted 2026-09-09)
No public figure.
Leak-site victims1,282 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Urschel Laboratories | · Jun 5, 2026 | — |
| Dallis Law Firm | · Jun 5, 2026 | — |
| The Chapel | · Jun 5, 2026 | — |
| Corley MFG | · Jun 5, 2026 | — |
| Digitall Graphics | · Jun 1, 2026 | — |
| Hightower Communications | · Jun 1, 2026 | — |
| GW Mechanical | · May 25, 2026 | — |
| NL Fisher | · May 25, 2026 | — |
| Round Hill Country Club | · May 25, 2026 | — |
| Legend Networking & Telecom | · May 25, 2026 | — |
| MyPillow | · May 25, 2026 | — |
| De Waard Transport | · May 25, 2026 | — |
| Zuther Hautmann | · May 19, 2026 | — |
| Infoworld Membership Systems | · May 12, 2026 | — |
| Town Car International | · May 12, 2026 | — |
| Northern Mechanical Contractors | · May 12, 2026 | — |
| ACC Construction | · May 12, 2026 | — |
| IWC Food Service | · May 12, 2026 | — |
| Ashcroft Homes | · May 12, 2026 | — |
| DURAND-WAYLAND | · May 12, 2026 | — |
| K & E Distributing | · May 8, 2026 | — |
| Accessoires Outillage Ltee | · May 8, 2026 | — |
| EMA Engineering & Consulting | · May 7, 2026 | — |
| Crystal Point | · Apr 6, 2026 | — |
| Morphosis | · Apr 6, 2026 | — |
| Barnes Solicitors LLP | · Apr 4, 2026 | — |
| Sokolin | · Apr 4, 2026 | — |
| Brokk | · Mar 30, 2026 | — |
| Colorado Construction | · Mar 30, 2026 | — |
| Lucky Look | · Mar 30, 2026 | — |
| Weber Kracht & Chellew | · Mar 30, 2026 | — |
| Specflue | · Mar 30, 2026 | — |
| Kivells | · Mar 30, 2026 | — |
| Dock Pros | · Mar 30, 2026 | — |
| Ampex Data Systems | · Mar 30, 2026 | — |
| Valley Plating Inc | · Mar 30, 2026 | — |
| Witt UK Group | · Mar 30, 2026 | — |
| TPIS Industrial Services | · Mar 26, 2026 | — |
| All Real Estate Title Solutions | · Mar 24, 2026 | — |
| Roxiticus Golf Club | · Mar 24, 2026 | — |
| Pinnacle | · Mar 24, 2026 | — |
| Ascent Asset Group | · Mar 24, 2026 | — |
| Capital Wholesale Drug | · Mar 24, 2026 | — |
| Block Engineering | · Mar 24, 2026 | — |
| Window & Door Design Center of Florida | · Mar 24, 2026 | — |
| Knight's Site Services | · Mar 17, 2026 | — |
| Gsolutionz | · Mar 17, 2026 | — |
| Executive Aviation | · Mar 15, 2026 | — |
| Circle Floors | · Mar 12, 2026 | — |
| Eagle Industrial Equipment | · Mar 12, 2026 | — |
In the newsAll →
No articles mention this group yet.