# What is Play ransomware?

Play, also called Playcrypt, is a ransomware group active since June 2022. CISA, the FBI and the Australian Cyber Security Centre described it in joint advisory AA23-352A of 18 December 2023, then counting about 300 affected entities; an update in June 2025 said the FBI knew of approximately 900 as of May 2025. Play uses double extortion, but its ransom note states no amount: victims are told to make contact by e-mail, and the update notes that some were also phoned and threatened. Initial access typically comes from valid accounts that were stolen or bought, and from vulnerabilities in internet-facing systems such as remote-desktop and firewall services. The group recompiles its malware for each attack, so file hashes are of limited use. Behaviour is more reliable: credential theft, movement between internal machines, and data gathered and sent out before encryption, which network monitoring can see.

FAQ: [Ransomware groups and families](https://netsenx.com/en/faq/ransomware-families) · https://netsenx.com/en/faq/what-is-play-ransomware

## Read next

- https://netsenx.com/en/detect-ransomware-on-the-network
- https://netsenx.com/en/blog/2026-10-24_ransomware-protection

## Related questions

- [What are Royal and BlackSuit ransomware?](https://netsenx.com/en/faq/what-are-royal-and-blacksuit-ransomware)
- [What is Rhysida ransomware?](https://netsenx.com/en/faq/what-is-rhysida-ransomware)
- [What is Medusa ransomware?](https://netsenx.com/en/faq/what-is-medusa-ransomware)
- [What is RansomHub ransomware?](https://netsenx.com/en/faq/what-is-ransomhub-ransomware)
- [What is Cl0p ransomware?](https://netsenx.com/en/faq/what-is-cl0p-ransomware)