Play
- ID
- G1040
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.[1][2]
Techniques used (26)
- T1003.001 LSASS Memory
- T1016 System Network Configuration Discovery
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1027.010 Command Obfuscation
- T1030 Data Transfer Size Limits
- T1048 Exfiltration Over Alternative Protocol
- T1057 Process Discovery
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1070.004 File Deletion
- T1078 Valid Accounts
- T1078.002 Domain Accounts
- T1078.003 Local Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1105 Ingress Tool Transfer
- T1133 External Remote Services
- T1190 Exploit Public-Facing Application
- T1518.001 Security Software Discovery
- T1560.001 Archive via Utility
- T1587.001 Malware
- T1588.002 Tool
- T1657 Financial Theft
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
Software used (9)
- S0002 Mimikatz
- S0029 PsExec
- S0154 Cobalt Strike
- S0359 Nltest
- S0363 Empire
- S0521 BloodHound
- S0552 AdFind
- S0645 Wevtutil
- S1162 Playcrypt