APT GroupHigh for ATT&CK-tracked aliases and TTP mappings; operating status and victimology should be verified against current vendor/government reporting. confidence

Play

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

Directory Briefing

Top 10 Talking Points

Play should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Local Accounts; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

The retained sequence includes System Network Configuration Discovery, Remote System Discovery, and Process Discovery, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes Windows Command Shell and PowerShell; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.¹

The retained record includes Archive via Utility, Data Transfer Size Limits, and Exfiltration Over Alternative Protocol, making repository, email, cloud, and egress review central to impact assessment.

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Bottom Line Up Front

BLUF

Play should be treated as an intrusion cluster, not a single immutable toolkit.¹

Vendor aliases describe overlapping activity sets; attribution can guide hypotheses, but containment should be driven by the behaviors and access paths actually observed.

Initial access should be scoped across identity and Internet-facing systems.¹

The retained behavior points to Local Accounts; preserve authentication, VPN, edge-device, email, and remote-administration evidence together.

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

The retained sequence includes System Network Configuration Discovery, Remote System Discovery, and Process Discovery, which supports scoping beyond the initially affected host.

Identity compromise is a central scoping issue.¹

Evidence includes credential or account abuse; response should cover privileged, service, remote-access, SaaS, and recovery identities—not just interactive user passwords.

The investigation should distinguish transient execution from durable access.¹

Review accounts, scheduled execution, remote-management tooling, cloud configuration, and externally reachable infrastructure for residual access.

Legitimate administration tools may carry much of the attack.¹

Reported tooling or behavior includes Windows Command Shell and PowerShell; detection must distinguish authorized administration from anomalous context and sequence.

The actor may reduce visibility before the main objective is reached.¹

Defense impairment or evidence removal is retained in the source record. Preserve endpoint, identity, network, and cloud telemetry outside the affected environment.

Collection and exfiltration reveal the likely mission.¹

The first briefing should separate containment confidence from attribution confidence.¹

State what access is confirmed, what persistence has been closed, what information may have been collected, and which attribution judgments remain source-bound.

Decision Context

Executive Summary

Actor Card Detail

Actor Profile

Entity Type¹

Ransomware/extortion association reported in public sources; confirm brand/affiliate relationships per incident.

First Seen¹

2024-09-24

Last Seen¹

ATT&CK record modified 2024-10-02; operational last-seen varies by source

Origin¹

Unknown

Motivation¹

Financial

Primary Access Pattern¹

Enterprise identity, exposed services, remote access, endpoint, backup, and data-exfiltration paths.

Objective¹

Financial

Victimology

Named Victims / Public Disclosures

No named victim organizations are retained in the cited source artifacts for this profile. Countries and sectors are targeting context, not victim identities.

Identity

Aliases And Boundaries

Aliases¹

Play

Source Boundary

attack.mitre.org is the retained baseline for this profile. IntelliOS preserves source labels as discovery and comparison signals until a cited source explicitly supports a merge, split, or actor-boundary change.

Targeting

Targets, Activity, And ATT&CK

Target Countries / Exposure

Not available

Target Sectors

GovernmentHealthcareMediaCross-industry

Associated Activity¹

Unusual archive creation, mass file reads, backup deletion, ransom note creation, encryption activity, and data-leak site pressure.Long-tail credential use, stealthy persistence, living-off-the-land execution, targeted collection, and encrypted outbound C2.Telemetry aligned to T1030 Data Transfer Size Limits.Telemetry aligned to T1016 System Network Configuration Discovery.Telemetry aligned to T1048 Exfiltration Over Alternative Protocol.

ATT&CK IDs¹

T1030 Data Transfer Size Limits (exfiltration)T1016 System Network Configuration Discovery (discovery)T1048 Exfiltration Over Alternative Protocol (exfiltration)T1070.004 File Deletion (stealth)T1059.003 Windows Command Shell (execution)T1059.001 PowerShell (execution)T1560.001 Archive via Utility (collection)T1018 Remote System Discovery (discovery)T1057 Process Discovery (discovery)T1027.010 Command Obfuscation (stealth)T1587.001 Malware (resource development)T1078.003 Local Accounts (stealth)

Campaign Context

Associated Campaigns / Operations

Campaign / Operation	Source-Backed Context
play Ransomware / Extortion Operations⁴	play Ransomware / Extortion Operations is retained in the campaign database for play. Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the...

Campaign / Operation

Source-Backed Context

play Ransomware / Extortion Operations⁴

play Ransomware / Extortion Operations is retained in the campaign database for play. Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.<br> <br> On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the...

Indicators

IOCs And Observable Retention

SOCRadar reported 24IntelliOS retained 24²

SOCRadar reports an unstated number of IOCs for this profile. IntelliOS currently retains 24 cited public observable/context rows; this is not the full possible public-source IOC corpus.

Source coverage: 3 source groups tracked; 1 currently contributes retained observable or context rows.

Retained Observables

Showing 24 of 24

Type	Value	Source
SHA-256 Hash	0E408AED1ACF902A9F97ABF71CF0DD354024109C5D52A79054C421BE35D93549²	CISA AA23-352A
SHA-256 Hash	1409E010675BF4A40DB0A845B60DB3AAE5B302834E80ADEEC884AEBC55ECCBF7²	CISA AA23-352A
SHA-256 Hash	372F7B45A141BB0709D578BC716CBCA03104258822C4290CCBEB600223850158²	CISA AA23-352A
SHA-256 Hash	453257C3494ADDAFB39CB6815862403E827947A1E7737EB8168CD10522465DEB²	CISA AA23-352A
SHA-256 Hash	47B7B2DD88959CD7224A5542AE8D5BCE928BFC986BF0D0321532A7515C244A1E²	CISA AA23-352A
SHA-256 Hash	511F63455CA4F83B0347B65DDA17585AD02591A9F23D8E234E5CE1321AA3381A²	CISA AA23-352A
SHA-256 Hash	6DE8DD5757F9A3AC5E2AC28E8A77682D7A29BE25C106F785A061DCF582A20DC6²	CISA AA23-352A
SHA-256 Hash	75404543DE25513B376F097CEB383E8EFB9C9B95DA8945FD4AA37C7B2F226212²	CISA AA23-352A
SHA-256 Hash	75B525B220169F07AECFB3B1991702FBD9A1E170CAF0040D1FCB07C3E819F54A²	CISA AA23-352A
SHA-256 Hash	7A42F96599DF8090CF89D6E3CE4316D24C6C00E499C8557A2E09D61C00C11986²	CISA AA23-352A
SHA-256 Hash	7DEA671BE77A2CA5772B86CF8831B02BFF0567BCE6A3AE023825AA40354F8ACA²	CISA AA23-352A
SHA-256 Hash	859165041D75FBA3759C5533E324225F355C8A07B4645B984192AD6BEF06DB1A²	CISA AA23-352A
SHA-256 Hash	90040340EE101CAC7831D7035230AC8AD4224D432E5636F34F13AA1C4A0C2041²	CISA AA23-352A
SHA-256 Hash	967DAFF362E63FF45526F585B7944488ACE1BB5BB5B30FA40D56557F1C538D09²	CISA AA23-352A
SHA-256 Hash	C59F3C8D61D940B56436C14BC148C1FE98862921B8F7BAD97FBC96B31D71193C²	CISA AA23-352A
SHA-1 Hash	3D86555ACAA19AEDDB5896071D1E3711B062EDBE²	CISA AA23-352A
Filename	fThe9C.exe²	CISA AA23-352A
Filename	Gt_net.exe²	CISA AA23-352A
Filename	Hi.exe²	CISA AA23-352A
Filename	HRsword.exe²	CISA AA23-352A
Filename	PSexesvc.exe²	CISA AA23-352A
Filename	SVCHost.dll²	CISA AA23-352A
Filename	Usysdiag.exe²	CISA AA23-352A
Campaign Context	Thin Play row backfilled from the same CISA/FBI/ASD ACSC source set as the SOCRadar Play Ransomware card; IntelliOS retains duplicate-card boundaries for reader interpretation.²	CISA AA23-352A

Source	Reported	Retained	Coverage Status
SOCRadar	N/A	0	Profile retained; no SOCRadar IOC count currently stored.
CISA/FBI/ASD ACSC²	N/A	24	Public observables or source-context rows retained and displayed.
MITRE ATT&CK / CTI¹	N/A	0	Technique and identity context retained; not treated as raw IOC feed for this card.

Actor Chronology

Observed Activity Timeline

No source-backed actor-activity dates are currently retained. Publication and record-maintenance dates are not promoted into activity dates.

IntelliOS Intel Products

Linked Products

None Found

Source Integrity AppendixSource reconciliation, citations, and collision-boundary analysisOpen

Source Reconciliation

How IntelliOS Keeps The Labels Straight

Source	Primary Name	Treatment	Boundary
attack.mitre.org	Play	Baseline actor-card record retained for the current profile view.	Fields reflect the retained database record. Additional source consensus, collisions, and canonical identity mappings can be layered into this profile without automatically merging actors.
IntelliOS	Play	Normalizes this record for directory search, card display, profile lookup, and future product linking.	Normalization is a presentation and workflow aid; it is not an independent attribution claim.

Open retained source profile

Source Collision Notes

Open Interpretation Boundaries

IntelliOS starts this detail page from the retained source record for Play.

No possible same-actor, alias reuse, sub-cluster, duplicate-boundary, or external-source collision is currently retained for this actor.

Collision Source	Candidate Records	Shared Evidence	Treatment
None retained	No candidate records	No shared evidence recorded	No collision action needed.
External sources	Mandiant, CrowdStrike, other non-SOCRadar sources	None retained	External collisions are shown separately when retained.

Citations

Source Notes

#	Source	Use In Card
1	MITRE ATT&CK https://attack.mitre.org/groups/G1040/	ATT&CK source for group, campaign, software, alias, and technique mappings where matched.
2	CISA AA23-352A: StopRansomware Play Ransomware https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a	IOC Source
3	Trend Micro Research. (2023, July 21). Ransomware Spotlight: Play. Retrieved September 24, 2024. https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play	Trend Micro Ransomware Spotlight Play July 2023
4	play - Ransomware.live group profile https://www.ransomware.live/group/play	Ransomware.live campaign row source for play Ransomware / Extortion Operations.

Loading Threat Actor Cards

Play

Top 10 Talking Points

Play should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1

Identity compromise is a central scoping issue.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

Collection and exfiltration reveal the likely mission.1

The first briefing should separate containment confidence from attribution confidence.1

BLUF

Play should be treated as an intrusion cluster, not a single immutable toolkit.1

Initial access should be scoped across identity and Internet-facing systems.1

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.1

Identity compromise is a central scoping issue.1

The investigation should distinguish transient execution from durable access.1

Legitimate administration tools may carry much of the attack.1

The actor may reduce visibility before the main objective is reached.1

Collection and exfiltration reveal the likely mission.1

The first briefing should separate containment confidence from attribution confidence.1

Executive Summary

Actor Profile

Named Victims / Public Disclosures

Aliases And Boundaries

Targets, Activity, And ATT&CK

Associated Campaigns / Operations

IOCs And Observable Retention

Observed Activity Timeline

Linked Products

How IntelliOS Keeps The Labels Straight

Open Interpretation Boundaries

Source Notes

Play should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

Identity compromise is a central scoping issue.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

Collection and exfiltration reveal the likely mission.¹

The first briefing should separate containment confidence from attribution confidence.¹

Play should be treated as an intrusion cluster, not a single immutable toolkit.¹

Initial access should be scoped across identity and Internet-facing systems.¹

A confirmed foothold may represent a hands-on-keyboard enterprise intrusion.¹

Identity compromise is a central scoping issue.¹

The investigation should distinguish transient execution from durable access.¹

Legitimate administration tools may carry much of the attack.¹

The actor may reduce visibility before the main objective is reached.¹

Collection and exfiltration reveal the likely mission.¹

The first briefing should separate containment confidence from attribution confidence.¹