Threat intelligence / Group

Play

[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[Play](https://attack.mitre.org/groups/G1040) is a ransomware group that has been active since at least 2022 deploying [Playcrypt](https://attack.mitre.org/software/S1162) ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Play](https://attack.mitre.org/groups/G1040) actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

35 recorded

Relationships

uses

Tool

uses

to Archive via Utility

Technique

uses

Tool

uses

to Clear Windows Event Logs

Technique

uses

to Cobalt Strike

Malware

uses

to Command Obfuscation

Technique

uses

to Data Transfer Size Limits

Technique

uses

to Disable or Modify Tools

Technique

uses

to Domain Accounts

Technique

uses

Tool

uses

to Exfiltration Over Alternative Protocol

Technique

uses

to Exploit Public-Facing Application

Technique

uses

to External Remote Services

Technique

uses

to File and Directory Discovery

Technique

uses

to File Deletion

Technique

uses

to Financial Theft

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Accounts

Technique

uses

to LSASS Memory

Technique

uses

Technique

uses

Tool

uses

Tool

uses

Malware

uses

Technique

uses

to Process Discovery

Technique

uses

Tool

uses

to Remote System Discovery

Technique

uses

to Security Software Discovery

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to System Information Discovery

Technique

uses

to System Network Configuration Discovery

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

Tool

uses

to Windows Command Shell

Technique

3 external

References

mitre-attack

G1040

CISA Play Ransomware Advisory December 2023

https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a

Trend Micro Ransomware Spotlight Play July 2023

https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play