Home/Threat Actor/Play
Threat Actor

Play

play_ransomware · russia_aligned_cybercrime · active since 2022

Play (Playcrypt / Balloonfly / G1040) is one of the more operationally consequential ransomware operations of the 2022- 2024 period - a financially-motivated organized cyber-criminal cluster operating from Russia and adjacent post-Soviet states emerging in June 2022 - with documented compromise of 300+ organizations globally per CISA + FBI + ACSC + ASD joint cybersecurity advisory AA23-352A (December 18, 2023)

most operationally consequential cluster-tradecraft contribution the OWASSRF (Outlook Web Access Server-Side Request Forgery) Microsoft Exchange exploitation chain (CVE-2022-41080 + CVE-2022-41082) discovered during CrowdStrike incident response on the early-December-2022 Rackspace Technology Hosted Exchange attack - operationally consequential beyond Rackspace because Exchange environments worldwide were vulnerable pending the January 2023 Microsoft patch.

high-profile documented victims including Rackspace Technology Hosted Exchange (December 2022, thousands of customer email service disruption for multiple weeks), City of Oakland California (February 2023, weeks of city government IT disruption), Arnold Clark UK automotive retailer (December 2022 - January 2023), H-Hotels German hotel chain (December 2022), Belgian city of Antwerp (December 2022), A10 Networks (January 2023), Krispy Kreme (multiple 2023 incidents), Microchip Technology US semiconductor (August 2024); distinctive operational branding via .play file extension and minimalist "PLAY"-plus-contact-email ransom note style contrasting with verbose-marketing peer ransomware operations.

initial-access tradecraft centers on Microsoft Exchange exploitation via ProxyNotShell and OWASSRF, FortiOS SSL VPN exploitation (CVE-2018-13379 / CVE-2022-42475 / CVE-2023-27997), and RDP credential theft.

operationally unusual selective Ukrainian targeting pattern documented by Microsoft Threat Intelligence Center across 2022-2024 (operationally unusual among predominantly-Western-victim-focused ransomware operations, most of which avoid CIS-state targets including Ukraine) consistent with broader Russian state security service interests in targeting Ukrainian infrastructure during the ongoing Russia- Ukraine war - contributing to selective vendor analysis questioning whether Play maintains operational coordination with Russian state security service interests beyond pure financially- motivated cybercrime, though Play remains primarily financially- motivated cybercrime operationally.

russia_aligned_cybercrime confidence: high 13 aliases MITRE ATT&CK G1040 ↗
Hunt package↗ Sigma rules26 YARA rules49 Live IOCs19 CVEs exploited11
⬢

Profile

Play (also tracked as Playcrypt, Balloonfly [Microsoft], and MITRE ATT&CK G1040) is one of the more operationally consequential ransomware operations of the 2022-2024 period
  • a financially- motivated organized cyber-criminal cluster operating from Russia and adjacent post-Soviet states. The cluster emerged in June 2022 and represents one of the more sustained operationally- mature ransomware operations of the period with documented compromise of 300+ organizations globally per the CISA + FBI + Australian Cyber Security Centre + Australian Signals Directorate joint cybersecurity advisory AA23-352A (December 18, 2023). The cluster's distinctive operational branding is the .play file extension appended to encrypted files combined with a minimalist ransom note style (the word "PLAY" alone followed by a contact email address)
  • operationally distinctive branding relative to verbose-ransom-note peer ransomware operations. The branding choice contrasts with the verbose-marketing branding of many peer ransomware operations and reflects the cluster's operational positioning as understated rather than attention-seeking. The cluster's most operationally consequential cluster-tradecraft contribution was the OWASSRF (Outlook Web Access Server-Side Request Forgery) Microsoft Exchange exploitation chain discovered during CrowdStrike incident response on the early-December-2022 Rackspace Technology Hosted Exchange attack and disclosed in late December 2022. The OWASSRF chain combined CVE-2022-41080 and CVE-2022-41082 in a novel server-side-request-forgery-then- remote-code-execution attack against Microsoft Exchange environments. The OWASSRF discovery was operationally consequential beyond the Rackspace incident because Exchange environments worldwide were vulnerable to the chain pending the eventual January 2023 Microsoft patch. The Rackspace incident itself disrupted email services for thousands of Rackspace Hosted Exchange customers across the US for multiple weeks. Operationally Play's initial-access tradecraft has centered on three primary patterns: First, Microsoft Exchange exploitation via ProxyNotShell (CVE-2022-41040 + CVE-2022-41082) and the OWASSRF chain (CVE-2022-41080 + CVE-2022-41082) across late 2022 and 2023. Second, FortiOS SSL VPN exploitation including CVE-2018-13379, CVE-2022-42475, and CVE-2023-27997. The FortiOS-targeting tradecraft is consistent with broader contemporary cybercrime- cluster patterns of exploiting Fortinet, SonicWall, Cisco, and other VPN-and-perimeter-security-product vulnerabilities for initial access. Third, RDP credential theft and exploitation of internet-exposed RDP services. The cluster operates Linux + ESXi ransomware variants alongside the Windows variant.
  • consistent with broader contemporary cybercrime-cluster patterns of VMware ESXi hypervisor targeting for disproportionately high operational impact relative to deployment effort. An operationally unusual cluster signature is the selective Ukrainian targeting pattern documented across 2022-2024. Microsoft Threat Intelligence Center has tracked Play ransomware deployments against Ukrainian organizations including selected Ukrainian government and commercial entities. The Ukrainian- targeting pattern is operationally unusual among predominantly- Western-victim-focused ransomware operations.
  • most major ransomware operations explicitly avoid Russia, Belarus, and CIS-state targets including Ukraine.
  • and is consistent with broader Russian state security service interests in targeting Ukrainian infrastructure during the ongoing Russia-Ukraine war. The pattern has contributed to selective vendor analysis questioning whether Play maintains operational coordination with Russian state security service interests beyond pure financially- motivated cybercrime, though Play remains primarily financially- motivated cybercrime operationally and the Ukrainian-targeting pattern represents a small fraction of overall cluster operational volume. High-profile documented Play victims include Rackspace Technology Hosted Exchange (December 2022), City of Oakland California (February 2023), Arnold Clark UK automotive retailer (December 2022.
  • January 2023), H-Hotels German hotel chain (December 2022), Belgian city of Antwerp (December 2022), A10 Networks (January 2023), Krispy Kreme (multiple 2023 incidents), Microchip Technology US semiconductor (August 2024), and hundreds of additional commercial and government-sector targets. A handful of operational notes: First, the cluster represents one of the more sustained operationally-mature ransomware operations of the 2022-2024 period with consistent operational tempo and continued capability development across the operational lifespan. The 300+ documented victims and the diversity of high-profile incidents (Rackspace Exchange supply-chain impact, City of Oakland municipal government, Belgian Antwerp city government, Arnold Clark UK automotive supply-chain disruption) demonstrate substantial operational impact. Second, the OWASSRF Exchange exploitation chain discovery during the December 2022 Rackspace incident response represents one of the more operationally consequential contemporary cybercrime- cluster contributions to the broader threat-intelligence community vulnerability-research understanding. The pattern of financially-motivated cluster operations driving discovery of enterprise-infrastructure vulnerability chains (rather than vulnerability-disclosure preceding cluster exploitation) is operationally significant. Third, the selective Ukrainian targeting pattern represents one of the more analytically interesting elements of the cluster profile. The pattern complements the broader analytical framing applied to Wizard Spider / Conti (ContiLeaks-revealed apparent intelligence-service-adjacent contacts), Indrik Spider / Evil Corp (OFAC explicit Russian FSB tasking allegation), and Black Basta (BlackBastaLeaks-revealed apparent connections) where elements of the Russia-speaking organized cybercrime ecosystem maintain operational coordination with Russian state security service interests. The cumulative pattern across multiple clusters supports the broader gray-zone analytical framing for the Russia-speaking organized-cybercrime-and-state-security- services intersection. Fourth, no formal individual-operator attribution at the named- Russian-national tier has been publicly issued for Play administrators.
  • consistent with the broader pattern of absence of similar named-individual-attribution for Cl0p, ALPHV / BlackCat, Black Basta, and Akira. Only LockBit (Khoroshev), Evil Corp (Yakubets / Turashev), and FIN7 (Dunaev / Hladyr / Kolpakov / Witte) have received named-Russian-national-tier formal attribution among the major contemporary cybercrime clusters covered in this corpus.
☉

Aliases

13
playplay ransomwareplay_ransomwareplayransomwareplaycryptplay cryptplay_cryptballoonflyballoon flyballoon_flyg1040atk 256atk256
⌖

Notable Campaigns

9
2024-2025Continued Operations (2024-2025)
2023-2024FortiOS SSL VPN Exploitation (2023-2024)
2023-2024Additional High-Profile Victims (2023-2024)
2023City of Oakland California Attack (February 2023)
2023CISA + FBI + ACSC + ASD AA23-352A Play Cybersecurity Advisory (December 18, 2023)
2022-2024Selective Ukrainian Targeting Pattern (2022-2024)
2022-2023ProxyNotShell + OWASSRF Microsoft Exchange Exploitation (Late 2022 - 2023)
2022Play Ransomware Emergence (June 2022)
2022Rackspace Technology Hosted Exchange Attack (December 2022)
★

Attribution & Reporting

Attributed by
FBI Cyber DivisionCISA (US Cybersecurity and Infrastructure Security Agency)Australian Cyber Security Centre (ACSC)Australian Signals Directorate (ASD)Mandiant / Google Cloud Threat IntelligenceMicrosoft Threat Intelligence CenterCrowdStrikeRecorded Future Insikt GroupSentinelOneSophosTrend MicroKaspersky GReATGroup-IBPRODAFTCybereasonIBM X-ForceTrustwave SpiderLabsTrellixDFIR ReportCovewareHalcyonPalo Alto Networks Unit 42Symantec (Broadcom)AdluminCisco Talos
Key reporting
reportCISA + FBI + ACSC + ASD: AA23-352A #StopRansomware Play Ransomware Joint Cybersecurity Advisory (December 18, 2023) - most operationally significant international government formal public attribution
reportCrowdStrike: OWASSRF Exploit Analysis and Recommendations (December 20, 2022) - seminal OWASSRF discovery during Rackspace incident response
reportMicrosoft Threat Intelligence: Balloonfly / Play Ransomware Tracking (May 2023) - selective Ukrainian targeting documentation
reportSymantec (Broadcom): Play Ransomware Initial Discovery and Continued Tracking
reportMandiant: Playcrypt Ransomware Continued Tracking
reportCisco Talos: Play Ransomware Deep Dive
reportSophos: Play Ransomware Operational Profile
reportTrend Micro: Ransomware Spotlight Play (November 2022)
reportPalo Alto Networks Unit 42: Play Ransomware Spider Stash (April 2023)
reportRecorded Future Insikt Group: Play Ransomware Tracking (multiple years)
reportAdlumin: Play Ransomware Tracking Incident Response Data
reportCoveware: Play Ransomware Tracking
reportHalcyon: Play Operational Profile
reportPRODAFT: Play Detailed Operational Analysis
reportGroup-IB: Play Continued Tracking
reportSophos: Play Continued Tracking
reportDFIR Report: Play Operational Analysis
reportGuidePoint Security: Play Incident Response Tracking
reportMalpedia Actor Profile: Play
reportMITRE ATT&CK Group G1040 - Play
Sources & links
attack.mitre.org ↗ cisa.gov ↗ cyber.gov.au ↗ crowdstrike.com ↗ news.sophos.com ↗ blog.talosintelligence.com ↗ mandiant.com ↗ microsoft.com ↗ recordedfuture.com ↗ trendmicro.com ↗ symantec.com ↗ unit42.paloaltonetworks.com ↗ adlumin.com ↗ malpedia.caad.fkie.fraunhofer.de ↗
⬡

Operational

State sponsor
Play (also tracked as Playcrypt, Balloonfly, and MITRE ATT&CK G1040) is a financially-motivated organized cyber-criminal cluster
  • not a state-aligned cluster.
  • operating from Russia and adjacent post-Soviet states. The cluster has been associated with apparent operational coordination with Russian state security service interests in selected vendor analysis, similar to the broader analytical framing applied to Wizard Spider / Conti, Indrik Spider / Evil Corp, and Black Basta in this corpus.
  • though formal explicit OFAC-style allegations of state security service tasking have not been publicly issued against Play administrators. The cluster emerged in June 2022 and represents one of the more operationally consequential ransomware operations of the 2022-2024 period with documented compromise of 300+ organizations globally per the CISA + FBI + Australian Cyber Security Centre joint cybersecurity advisory AA23-352A (December 18, 2023). The cluster's selective vendor tracking has identified ongoing apparent state security service adjacencies.
  • notably Microsoft Threat Intelligence Center's tracking of selective Play ransomware deployment against Ukrainian organizations during 2022-2024 (operationally unusual among predominantly-Western-victim-focused ransomware operations and consistent with broader Russian state security service interests in targeting Ukrainian infrastructure during the ongoing Russia-Ukraine war)
  • though Play remains primarily financially-motivated cybercrime operationally. No formal individual-operator attribution at the named-Russian-national tier has been publicly issued for Play administrators.
Motivations
financial_gain, financially_motivated, cybercrime, ransomware_deployment, extortion, double_extortion, data_theft_for_extortion, ransomware_as_a_service_operations, selective_ukrainian_targeting_potentially_state_aligned
Sectors
governmentstate_local_governmentfederal_governmentcritical_infrastructurehealthcarehospitalshigher_educationschoolsfinancial_servicesbankinginsurancemanufacturingheavy_industryautomotivedefense_industrial_baseaerospaceretailhospitalityfood_servicetransportationlogisticsshippingenergyoil_and_gasutilitieschemical_industrylaw_firmsprofessional_servicesconsulting_firmsit_service_providersmanaged_service_providerscloud_service_providerssoftware_companiestechnologytelecommunicationsmedianon_governmental_organizationsreal_estateconstruction
Regions
united_statescanadaunited_kingdomgermanyfranceitalyspainnetherlandsbelgiumswedenaustralianew_zealandjapanindiabrazilmexicoargentinaukraine_selectivelatin_americaglobal_predominantly_western_with_selective_ukrainian
◇

Techniques Used

60
T1003T1003.001T1003.005T1003.006T1005T1016T1018T1027T1027.002T1027.005T1027.013T1033T1036T1036.004T1036.005T1039T1041T1053T1053.005T1057T1059T1059.001T1059.003T1059.005T1059.007T1068T1070T1070.001T1070.004T1071T1071.001T1074T1074.001T1078T1078.001T1078.002T1078.003T1078.004T1082T1083T1087T1087.001T1087.002T1090T1090.002T1095T1098T1105T1112T1119T1132T1132.001T1133T1135T1140T1189T1190T1199T1203T1204
Build a hunt packdeployable Splunk/Elastic/Sentinel detections for these techniques
◈

Public detection by layer

60 techniques
Across this actor’s 60 mapped techniques, the share for which public detection content exists in each layer (published detection content across Sigma, Elastic, MITRE CAR, Snort/Suricata, YARA, and Nuclei). Low bars mean little ready-made detection is published for this adversary, so you would likely have to write your own. This is a view of available public content, not of the rules you have deployed.
Behavioral / log (Sigma)57/60 · 95%
Analytics (MITRE CAR)30/60 · 50%
Runtime / container (Falco)8/60 · 13%
File / malware (YARA)1/60 · 1%
Network (Suricata/Snort)16/60 · 26%
Vuln scan (Nuclei)0/60 · 0%
SIEM (Splunk ESCU)56/60 · 93%
SIEM (Elastic)58/60 · 96%
SIEM (Azure Sentinel)17/60 · 28%
✓

Public detection by technique

59/60
Public detection content exists for 59 of this actor’s 60 mapped techniques (98%); 1 have no published detection content. The ones with no published rule are listed first - you would need to source or write detection for those. This reflects published rules, not your own deployment. Per-account coverage, where you upload your own rules and we compute your real gaps, is on the roadmap.
no public rule T1070.001 Clear Windows Event Logs
has rules T1059.001 PowerShell Sigma 219 rules 26
has rules T1190 Exploit Public-Facing Application Sigma 146 rules 63
has rules T1112 Modify Registry Sigma 95 rules 66
has rules T1059 Command and Scripting Interpreter Sigma 95 rules 20
has rules T1078 Valid Accounts Sigma 61 rules 51
has rules T1105 Ingress Tool Transfer Sigma 87 rules 21
has rules T1027 Obfuscated Files or Information Sigma 94 rules 4
has rules T1003.001 LSASS Memory Sigma 79 rules 10
has rules T1078.004 Cloud Accounts Sigma 41 rules 30
has rules T1098 Account Manipulation Sigma 34 rules 35
has rules T1053.005 Scheduled Task Sigma 51 rules 17
has rules T1068 Exploitation for Privilege Escalation Sigma 29 rules 32
has rules T1059.003 Windows Command Shell Sigma 45 rules 7
has rules T1036 Masquerading Sigma 40 rules 8
has rules T1071.001 Web Protocols Sigma 41 rules 6
has rules T1033 System Owner/User Discovery Sigma 30 rules 14
has rules T1082 System Information Discovery Sigma 33 rules 10
has rules T1087.002 Domain Account Sigma 21 rules 19
has rules T1203 Exploitation for Client Execution Sigma 33 rules 6
has rules T1003 OS Credential Dumping Sigma 36 rules 2
has rules T1204 User Execution Sigma 10 rules 27
has rules T1018 Remote System Discovery Sigma 17 rules 18
has rules T1059.005 Visual Basic Sigma 28 rules 4
has rules T1083 File and Directory Discovery Sigma 24 rules 5
has rules T1059.007 JavaScript Sigma 23 rules 4
has rules T1070 Indicator Removal Sigma 20 rules 6
has rules T1090 Proxy Sigma 22 rules 3
has rules T1036.005 Match Legitimate Resource Name or Location Sigma 21 rules 1
has rules T1070.004 File Deletion Sigma 15 rules 7
has rules T1133 External Remote Services Sigma 20 rules 2
has rules T1140 Deobfuscate/Decode Files or Information Sigma 18 rules 2
has rules T1005 Data from Local System Sigma 14 rules 5
has rules T1087 Account Discovery Sigma 16 rules 3
has rules T1053 Scheduled Task/Job Sigma 12 rules 6
has rules T1087.001 Local Account Sigma 13 rules 5
has rules T1016 System Network Configuration Discovery Sigma 12 rules 5
has rules T1071 Application Layer Protocol Sigma 7 rules 9
has rules T1041 Exfiltration Over C2 Channel Sigma 5 rules 6
has rules T1078.002 Domain Accounts Sigma 7 rules 4
has rules T1135 Network Share Discovery Sigma 7 rules 4
has rules T1003.005 Cached Domain Credentials Sigma 8 rules 1
has rules T1003.006 DCSync Sigma 7 rules 2
has rules T1057 Process Discovery Sigma 7 rules 2
has rules T1119 Automated Collection Sigma 5 rules 4
has rules T1189 Drive-by Compromise Sigma 3 rules 5
has rules T1078.001 Default Accounts Sigma 4 rules 3
has rules T1078.003 Local Accounts Sigma 5 rules 1
has rules T1027.005 Indicator Removal from Tools Sigma 4 rules 1
has rules T1036.004 Masquerade Task or Service Sigma 3 rules 1
has rules T1074.001 Local Data Staging Sigma 4
has rules T1095 Non-Application Layer Protocol Sigma 3 rules 1
has rules T1132.001 Standard Encoding Sigma 4
has rules T1074 Data Staged Sigma 2 rules 1
has rules T1199 Trusted Relationship Sigma 2 rules 1
has rules T1039 Data from Network Shared Drive Sigma 2
has rules T1090.002 External Proxy Sigma 2
has rules T1027.002 Software Packing Sigma 1
has rules T1027.013 Encrypted/Encoded File rules 1
has rules T1132 Data Encoding rules 1
▸

Atomic Test Plan

30 techniques
Runnable Atomic Red Team tests covering this actor’s mapped techniques - validate your detections against this specific adversary. Cross-reference the blind spots above. For authorized lab / purple-team use. Open the full builder
▶

Tools Used

2 mapped
S0002 · MimikatzS0111 · schtasks
Other tooling / TTPs (curation, not ATT&CK-mapped):
MEGA NZMETERPRETERMSHTASHARPHOUNDSPLASHTOP ABUSE
◈

CVEs Exploited

11
CVECVE-2018-13379
CVECVE-2022-41040
CVECVE-2022-41080
CVECVE-2022-41082
CVECVE-2022-42475
CVECVE-2023-27997
CVECVE-2023-29336
CVECVE-2023-3519
CVECVE-2024-29988
CVECVE-2024-38080
CVECVE-2024-38193
External lookups - second-class, for what we don’t hold ourselves
MITRE searchMalpediaGoogle
SOC and Response
CVE triage
Stack monitoring
Am I affected
IOC triage
KEV catalog
Recently exploited
Daily brief
Change tracking
Detection Engineering
Coverage workspace
Detection coverage
Coverage check
Telemetry ceiling
SIEM query builder
Sigma rules
SIEM rules
YARA rules
Network rules
D3FEND
Threat Hunting
Threat actors
ATT&CK techniques
Attack paths
Indicators
Ransomware groups
Atomic tests
Red Team and Pentest
Exploitability triage
Recon pack
Attack paths
CAPEC patterns
Adversary emulation
Compliance and GRC
Framework mapping
Control assessment
Audit view
Atlas Search Threat actors Techniques Tools & malware CWE CAPEC KEV catalog Package vulns
About All capabilities Pricing API docs Privacy policy Terms of service
threatengine.sh