What is Play ransomware?

Play, also called Playcrypt, is a ransomware group active since June 2022. CISA, the FBI and the Australian Cyber Security Centre described it in joint advisory AA23-352A of 18 December 2023, then counting about 300 affected entities; an update in June 2025 said the FBI knew of approximately 900 as of May 2025. Play uses double extortion, but its ransom note states no amount: victims are told to make contact by e-mail, and the update notes that some were also phoned and threatened. Initial access typically comes from valid accounts that were stolen or bought, and from vulnerabilities in internet-facing systems such as remote-desktop and firewall services. The group recompiles its malware for each attack, so file hashes are of limited use. Behaviour is more reliable: credential theft, movement between internal machines, and data gathered and sent out before encryption, which network monitoring can see.

← All 25 questions on Ransomware groups and familiesAll topics