MITRE ATT&CKgroup

G1040 Play

Published 2024-09-24 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.0
Created
2024-09-24

Description

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

Related

Uses · MITRE ATT&CK (35)

  • T1685 Disable or Modify Tools technique
  • T1685.005 Clear Windows Event Logs sub-technique
  • S1162 Playcrypt software (malware)
  • T1657 Financial Theft technique
  • T1027.010 Command Obfuscation sub-technique
  • S0645 Wevtutil software (tool)
  • S0552 AdFind software (tool)
  • S0521 BloodHound software (tool)
  • T1587.001 Malware sub-technique
  • T1588.002 Tool sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1070.004 File Deletion sub-technique
  • S0363 Empire software (tool)
  • S0359 Nltest software (tool)
  • T1190 Exploit Public-Facing Application technique
  • S0154 Cobalt Strike software (malware)
  • S0002 Mimikatz software (tool)
  • S0029 PsExec software (tool)
  • T1016 System Network Configuration Discovery technique
  • T1018 Remote System Discovery technique
  • T1030 Data Transfer Size Limits technique
  • T1048 Exfiltration Over Alternative Protocol technique
  • T1057 Process Discovery technique
Show all 35 ›

References