THREATOPS Actor Dossier
LIVE ← Dashboard

Play

G104027 reports
aliases · Play
Export dossier:
27
Reports
9
Techniques
6
Tactics
4
Countries
56%
Hunt coverage
1
Aliases

Analyst assessment — key judgments

  • Signature techniques: T1589.001 (Credentials), T1557 (Adversary-in-the-Middle), T1684.001 (Impersonation).
  • Primary targeting: US, SG, DE, BR.
  • Resurgent after a quiet period: 2 report(s) in last 30d vs 0 prior (+100%).
  • Recent movement: 4 new technique(s) in the last 30 days.
  • Hunt coverage 56% of 9 observed techniques (4 gap(s)).
  • Assessment confidence: medium (61).

Activity & trend

ResurgentLast 30d: 2 vs 0 prior (+100%)· first reported 2025-05-26 · last 2026-07-01
0
7d
2
30d
2
90d
27
All
0.2
Rpts/wk
Reporting timeline · 12 months

Movement — last 30 days

New techniques
T1557T1684.001T1608.006AML.T0073
Dropped (90d+)
T1588.006T1657T1684AML.T0016.002
Targeting gained
BR

Overview

Analyst triage
Intelligence summary

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

Top co-occurring indicators
    Aliases & naming
      Targeting · countries
        Targeting · named victims

          ATT&CK technique matrix

          Coverage vs hunt library:
          —
          Hunt-coverage gaps — prioritized

            Threat catalogue · engineering roadmap0

            Flagged detection-engineering queue

            Uncovered techniques you flagged for hunt / detection build-out, aggregated across every actor you visit. Stored locally in your browser.

              No techniques queued yet — flag a gap above to add it here.

              Infrastructure

              IOC type mix
              Tooling / malware families
                Tracked infrastructure

                Relationships

                Related actors (behavioral cluster)
                  Attributed malware
                  Campaigns
                  No behavioral cluster, attributed malware, or campaigns recorded for this actor yet.

                  Activity

                  30-day mention timeline
                  Recent reporting
                  TitleSourceSeverityCollected