Play: threat actor profile

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. (MITRE ATT&CK, G1040)

Attacks we reported

1. Nov 8, 2026 How to Use Signal for Secure and Private Messaging
2. Sep 28, 2026 GitHub Security Lab finds 24 Android bugs with AI taskflow agent

26 techniques MITRE has documented for this group

1. Resource Development Develop Capabilities: Malware T1587.001 · Obtain Capabilities: Tool T1588.002
2. Initial Access Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Local Accounts T1078.003 · External Remote Services T1133 · Exploit Public-Facing Application T1190
3. Execution Command and Scripting Interpreter: PowerShell T1059.001 · Command and Scripting Interpreter: Windows Command Shell T1059.003
4. Persistence Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Local Accounts T1078.003 · External Remote Services T1133
5. Privilege Escalation Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Local Accounts T1078.003
6. Stealth Obfuscated Files or Information: Command Obfuscation T1027.010 · Indicator Removal: File Deletion T1070.004 · Valid Accounts T1078 · Valid Accounts: Domain Accounts T1078.002 · Valid Accounts: Local Accounts T1078.003
7. Defense Impairment Disable or Modify Tools T1685 · Disable or Modify Tools: Clear Windows Event Logs T1685.005
8. Credential Access OS Credential Dumping: LSASS Memory T1003.001
9. Discovery System Network Configuration Discovery T1016 · Remote System Discovery T1018 · Process Discovery T1057 · System Information Discovery T1082 · File and Directory Discovery T1083 · Software Discovery: Security Software Discovery T1518.001
10. Lateral Movement Remote Services: SMB/Windows Admin Shares T1021.002
11. Collection Archive Collected Data: Archive via Utility T1560.001
12. Command and Control Ingress Tool Transfer T1105
13. Exfiltration Data Transfer Size Limits T1030 · Exfiltration Over Alternative Protocol T1048
14. Impact Financial Theft T1657

All threat actors · ATT&CK heatmap

MITRE ATT&CK® data © The MITRE Corporation, reproduced and distributed with the permission of The MITRE Corporation (Enterprise ATT&CK v20.0).