PLAY

Play ransomware, also referred to as PlayCrypt and play_ransomware, is a ransomware-as-a-service (RaaS) operation first spotted at the end of June 2022. It was named for the .play file extension and the word “PLAY” in its ransom note email. The malware is associated with double-extortion activity, with operators stealing data and threatening public release in addition to encrypting systems. The content describes Play as an active, high-volume ransomware threat that has impacted roughly 900 organizations by May 2025 according to cited FBI reporting, and as one of the top ransomware threats to critical infrastructure.

Play targets enterprise environments across multiple sectors, with explicit references to healthcare, manufacturing, and critical infrastructure victims. The American Hospital Association warned of rising double-extortion threats involving the Play group, and the content specifically notes impacts to hospitals and healthcare organizations. Publicly referenced victim activity includes the French Rugby Federation before the 2023 Rugby World Cup, Swiss government data exposure via supplier Xplain in 2023, Microchip Technology in 2024, and MyPillow in 2025. The victim tracking content shows a strong concentration in the United States, with additional victims across Canada, Europe, Asia-Pacific, Africa, Latin America, and the Caribbean.

The malware and its operators are described as using rapid post-compromise deployment compared with many peers. Reported tradecraft includes exploitation of public-facing applications, use of valid accounts, scheduled tasks, PowerShell, credential dumping including LSASS memory and NTDS theft, discovery of network services and security software, lateral movement via RDP and SMB/Windows Admin Shares, lateral tool transfer, data archiving, exfiltration over alternative protocols, remote access software for command and control, clearing Windows event logs, stopping services, inhibiting system recovery, disabling or modifying security tools, and encrypting data for impact. Huntress reporting cited in the content states that Play often deploys ransomware quickly and averages fewer than 10 actions before encryption in observed incidents.

Play has also been linked to defense evasion and recovery inhibition behaviors. The content states that PlayCrypt can use AlphaVSS to delete shadow copies, and ATT&CK-style mappings associate PlayCrypt with data encryption for impact, file and directory discovery, and inhibiting system recovery. Additional reporting says Play operators have used legitimate but vulnerable drivers to terminate EDR products. Splunk detection content also associates Play with use of wevtutil-style log disabling behavior.

The content further states that Play has exploited the Windows Common Log File System vulnerability CVE-2025-29824, and that multiple reports observed abuse of this flaw by Play-associated attackers before patching. Play is also listed among ransomware programs associated with Muddled Libra/Scattered Spider partnerships, though the content only states association rather than exclusive operational control.

A Linux/ESXi-focused variant is described in SentinelLABS reporting as the first known Linux version of Play ransomware. That sample referenced the .FinDom extension and the ransom email address findomswitch@fastmail.pw, artifacts associated with Play, and was assessed as Babuk-derived. The sample reportedly used the same file-searching functionality as baseline Babuk and Sosemanuk for encryption. The Play ESXi sample SHA1 is dc8b9bc46f1d23779d3835f2b3648c21f4cf6151, and the related archive SHA1 is 9290478cda302b9535702af3a1dada25818ad9ce. The archive reportedly contained AnyDesk, NetCat, a privilege-escalation batch file, and encoded PowerShell Empire scripts.

The content also states that Play uses intermittent encryption based on file size and encrypts chunks of 0x100000 bytes. Known artifacts and indicators mentioned in the content include the .play and .FinDom extensions, the ransom email findomswitch@fastmail.pw, email IOCs derdiarikucisv@gmx.de and raniyumiamrm@gmx.de, and a YARA artifact named Play.yar.