Play Ransomware (PlayCrypt): Threat Profile, Attack Chain & Incident Response Guide

Play ransomware, also known as PlayCrypt, is a ransomware operation first identified in June 2022 that combines a closed-group structure with a Ransomware-as-a-Service (RaaS) affiliate framework. The group distributes standardized deployment playbooks to vetted affiliates while maintaining strict internal controls, a structure that scales attack capacity without sacrificing operational security.

As of mid-2025, the FBI has confirmed more than 900 affected entities. Dark web telemetry tracks over 1,200 organizations named on Play's Tor-based leak site across more than 44 countries. Primary targets span government agencies, healthcare providers, critical infrastructure operators, financial institutions, and Managed Service Providers (MSPs), which are targeted both directly and as entry points into downstream customer environments.

How to identify a Play ransomware attack

Play leaves predictable forensic markers across both Windows and VMware ESXi environments, enabling security teams to identify active intrusions and post-encryption incidents early in the response process.

File and ransom note indicators

Files encrypted by Play receive the .play extension.

On Windows systems, the ransom note is named ReadMe.txt and is placed in C:\Users\Public\Music\ and at the root of C:\.

On VMware ESXi systems, the equivalent note is named PLAY_Readme.txt and is written to / and /vmfs/volumes/.

Victims are directed to contact operators via unique email addresses ending in @gmx.de or @web.de. No cryptocurrency wallet addresses appear in the initial note, and all payment communication is routed through email after first contact.

Behavioral and network indicators of compromise

The following tools and behaviors are documented in confirmed Play deployments and serve as high-confidence indicators of a Play intrusion:

• Grixba: Custom .NET information stealer targeting security software inventory and network share enumeration
• VSS Copying Tool: Custom utility that bypasses Volume Shadow Copy locks to access protected system files
• Cobalt Strike / SystemBC: Command-and-control (C2) frameworks operating via SOCKS5 proxy tunnels
• AdFind, Bloodhound: Active Directory reconnaissance utilities
• Mimikatz, WinPEAS: Credential harvesting and privilege escalation tooling
• GMER, IOBit, PowerTool, Process Hacker: Rootkit removal and process manipulation tools used to terminate EDR and EPP agents
• wevtutil: Windows-native utility, repurposed here to erase event logs and obstruct forensic reconstruction
• WinRAR, WinSCP: Data staging and SFTP-based exfiltration tooling
• Encoded Base64 PowerShell scripts: Used specifically to disable Microsoft Defender before payload execution

Play ransomware attack chain and TTPs

Play operates as a human-directed, multi-phase intrusion. Operators spend significant dwell time inside target environments before triggering encryption, using that window to map the network, eliminate defenses, and exfiltrate data. The phases below map each step to specific tools and observables.

Initial access

Play affiliates gain entry through several well-documented vectors. Fortinet SSL VPN appliances are exploited via path traversal and password-bypass vulnerabilities.

Microsoft Exchange servers are targeted using ProxyNotShell and OWASSRF, enabling server-side request forgery and remote code execution with elevated privileges.

A significant vector documented in the CISA/FBI/ASD ACSC Joint Advisory AA23-352A, updated June 2025, is CVE-2024-57727, an unauthenticated remote code execution flaw in SimpleHelp Remote Monitoring and Management (RMM) software.

Credentials are also sourced from dark web marketplaces and through Initial Access Brokers (IABs). Play affiliates additionally use phishing campaigns for credential harvesting alongside these technical access vectors.

Execution, persistence, and privilege escalation

After gaining initial access, operators establish persistence through scheduled tasks, Windows Management Instrumentation (WMI), PsExec, and Group Policy Object (GPO) deployment. Mimikatz extracts LSA credentials from memory, while WinPEAS audits the environment for available privilege escalation paths.

Operators routinely create new Domain Administrator accounts to maintain access independently of the original entry point.

Lateral movement relies heavily on living-off-the-land binaries (LOLBins), which allow operators to blend malicious commands into traffic that resembles normal administrative activity.

Discovery and lateral movement

Grixba performs an early enumeration sweep identifying installed security software, backup system paths, and accessible network shares.

AdFind and Bloodhound map Active Directory trust relationships and administrator group membership. Nltest and Netscan handle additional host and domain discovery, while Cobalt Strike paired with SystemBC maintains persistent C2 channels throughout the dwell period.

Defense evasion

Play's most operationally significant evasion technique is per-campaign binary recompilation: the ransomware payload is rebuilt from source for each victim deployment, generating a unique cryptographic hash per attack. This approach systematically defeats static signature-based antivirus and EDR detection without requiring changes to the underlying functionality.

EDR and EPP agents are terminated using GMER, IOBit, PowerTool, and Process Hacker before the payload executes. Microsoft Defender is specifically targeted through encrypted Base64-encoded PowerShell scripts. Event logs are erased using wevtutil to limit post-incident forensic reconstruction.

Amr Fathy, Senior DFIR Engineer at Proven Data, notes that encoded PowerShell is a particularly effective evasion mechanism because legitimate administrative tooling relies on it routinely, conditioning analysts to treat those alerts as expected baseline noise. Without correlation to surrounding activity, that signal disappears even when it is technically present in logs.

Understanding the full scope of EDR capabilities and anti-tamper limitations is essential context for teams assessing their detection coverage against evasion at this level.

Exfiltration and extortion

Before deploying the encryption payload, Play operators compress stolen data into split .rar archives using WinRAR, then transfer them to attacker-controlled infrastructure via WinSCP SFTP. After exfiltration is complete, the intermittent encryption payload executes.

Extortion operates on two simultaneous tracks: stolen data is staged for publication on Play's Tor-based leak site, while threat actors place direct telephone calls to victim organizations, targeting help desk staff, receptionists, and executives via contact details sourced from publicly available records.

This dual extortion approach is documented in the Joint Advisory as a deliberate tactic to apply pressure independently of the technical impact of encryption.

MITRE ATT&CK mapping

The ESXi variant and intermittent encryption mechanics

Play developed two technical capabilities that differentiate it from most ransomware families: a dedicated hypervisor-targeting Linux variant and an encryption method designed to reduce the behavioral signals that EDR solutions use for detection.

VMware ESXi targeting

Play's Linux variant is a dedicated C/C++ ELF binary built specifically for VMware ESXi environments.

On execution, it runs ESXi shell commands to enumerate all running virtual machines via vim-cmd vmsvc/getallvms and powers them off. It overwrites the login welcome banner at /etc/motd with the ransom note. Targeted file types include .vmdk, .vmem, .vmx, .vmsd, .vmss, .nvram, and .log.

The ESXi variant differs from the Windows payload across several technical dimensions:

For organizations running VMware ESXi infrastructure, the recovery process differs substantially from Windows-only environments in sequencing, tooling, and what can be salvaged from affected virtual disk images.

The broader landscape of ESXi-targeting ransomware provides useful context on hypervisor recovery complexity.

Intermittent encryption mechanics

Rather than encrypting files sequentially, Play encrypts every other 1MB block (0x100000 bytes), leaving alternating chunks unmodified. This design reduces the speed at which large-scale data modification is detected by behavioral EDR solutions, which commonly flag ransomware by the rate of file change rather than per-file analysis. By alternating between encrypted and unencrypted blocks, Play extends the window before behavioral thresholds are crossed.

On Windows, Play uses a hybrid AES-RSA encryption scheme. On ESXi, AES-256 is applied directly. Both produce files that are unrecoverable without the decryption key, despite appearing partially intact to file system tooling.

High-profile incidents and target profile

Play has confirmed victims across government, healthcare, finance, telecommunications, and IT services in more than 44 countries.

MSP targeting is a deliberate component of Play's strategy. A single compromised MSP can give operators access to that provider's entire client base, multiplying the footprint of one intrusion across potentially dozens of downstream organizations.

Magdy Abdelaziz, Head of DFIR at Proven Data, explains that human-operated ransomware like Play produces disproportionately severe outcomes compared to automated campaigns because operators actively adapt during the intrusion. In Play-type engagements, threat actors identify and neutralize backup infrastructure, selectively collect high-value data, turn off defenses in deliberate sequence, and time detonation for maximum operational impact. Post-incident forensics surface this behavior through hands-on-keyboard commands, staged tooling, targeted lateral movement, backup console access logs, and coordinated payload execution across multiple systems.

Incident response and prevention

Effective response to a Play incident requires immediate containment, forensic preservation, and targeted hardening of the specific vectors Play is documented to exploit.

Immediate response steps

When a Play infection is suspected or confirmed, the priority is isolating affected systems while preserving forensic state. Rebuilding or wiping systems before evidence is captured removes the data needed to determine intrusion scope, identify the initial access vector, and support cyber insurance claims. DFIR teams should be engaged before remediation begins.

Proven Data's incident response services provide immediate DFIR support for active ransomware incidents.

For technical guidance on safely containing compromised infrastructure, see how to isolate ransomware-infected servers.

Prevention and hardening checklist

The following controls are mapped directly to Play's documented attack vectors and operational patterns:

• Patch SimpleHelp RMM immediately to address CVE-2024-57727; isolate remote management interfaces from public network access
• Apply Microsoft Exchange Cumulative Updates addressing ProxyNotShell and OWASSRF; restrict PowerShell Remoting where not operationally required.
• Upgrade FortiOS firmware to versions resolving CVE-2018-13379 and CVE-2020-12812; require MFA on all VPN and remote access endpoints.
• Disable public-facing RDP; enforce Network Level Authentication (NLA) and account lockout policies across all remote access paths.
• Enable EDR anti-tamper protection in enforcement mode to prevent agent termination by tools including GMER, IOBit, PowerTool, and Process Hacker.
• Deploy immutable, air-gapped backups using the 3-2-1-1 model; test restores on a documented schedule and protect backup control plane credentials separately from production system credentials.

• Monitor process execution for Grixba and the VSS Copying Tool as early-stage recon and staging indicators; treat GMER, IOBit, PowerTool, or Process Hacker process creation as a critical pre-encryption alert requiring immediate triage.
• Alert on wevtutil log clearing and encoded Base64 PowerShell execution; correlate with surrounding activity to separate administrative use from malicious behavior.
• Conduct a privileged access audit: disable stale employee accounts, vendor VPN credentials, unused domain admins, backup service accounts, and unnecessary RMM tool installations.
• Train helpdesk and reception staff on telephone-based social engineering; Play operators call victim employees directly to pressure ransom payment and threaten public data exposure.