PLAY
PLAY is a Russia-attributed ransomware group with a financial motive, tracked by Brandefense. It targets 18 sectors, including Government and Technology, in 26 countries, including the United States and the United Kingdom. It uses 37 MITRE ATT&CK techniques.
- Play Team
- Origin
- Russia
- Techniques
- 37
- Exploited CVEs
- No CVE data
- First seen
- Nov 26, 2022
- Last seen
- Aug 31, 2026
- Record updated
Who They Target.
About PLAY.
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the.NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in.CSV files that are compressed into a.ZIP file for later manual exfiltration by threat actors.'Source:.
Last updated Oct 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.