Executive Summary
Play is a highly capable threat group that has executed high-profile attacks against government agencies and large corporations, including the Swiss Federal Administration and Rackspace. They employ a double-extortion model, encrypting data with a ".play" extension while threatening to release stolen sensitive information publicly. Evidence suggests potential tactical overlaps with other ransomware operations such as Hive and Nokoyawa.
The group's technical tradecraft is diverse, ranging from the exploitation of public-facing vulnerabilities (e.g., ProxyNotShell) to the use of specialized tools like Grixba for discovery and SystemBC for persistent command and control. Their ability to move laterally via Group Policy Objects and disable security software using kernel-level tools indicates a high level of operational maturity.
Play's global reach and successful compromise of critical government infrastructure make them a significant risk to both public and private sectors. Organizations are advised to prioritize patching known vulnerabilities in VPN and Exchange services and to monitor for unauthorized use of legitimate administration tools like Mimikatz, AdFind, and WinSCP.