MITRE ATT&CKsoftware (malware)
S1162 Playcrypt
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- Play
- Version
- 1.0
- Created
- 2024-09-25
Description
Playcrypt is a ransomware that has been used by Play since at least 2022 in attacks against against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Playcrypt derives its name from adding the .play extension to encrypted files and has overlap with tactics and tools associated with Hive and Nokoyawa ransomware and infrastructure associated with Quantum ransomware.
Related
Uses · MITRE ATT&CK (3)
Referenced by MITRE ATT&CK · uses (1)
- G1040 Play group
References
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a CISA Play Ransomware Advisory December 2023
- https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Ransom:Win32/PlayCrypt.PA&ThreatID=2147830341 Microsoft PlayCrypt August 2022
- https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play Trend Micro Ransomware Spotlight Play July 2023