Play

As of Oct 19, 2026, Play has listed 1,342 confirmed victims on its leak site since Mar 11, 2023, 4.2% of all victims tracked by Brandefense. Its most targeted country is United States (71.6% of its victims) and its most targeted sector is Manufacturing.

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the.NET infostealer…