play

T1078Valid Accounts

Compromised VPN credentials used to authenticate directly to victim networks.

T1190Exploit Public-Facing Application

Play exploits vulnerabilities in Microsoft Exchange (ProxyNotShell CVE-2022-41040/CVE-2022-41082), FortiOS SSL VPN (CVE-2018-13379), and RDP to gain initial access.

T1053.005Scheduled Task/Job: Scheduled Task

Scheduled tasks used for payload persistence and execution across compromised hosts.

T1059Command and Scripting Interpreter

T1059.001Command and Scripting Interpreter: PowerShell

PowerShell scripts used for payload execution and post-exploitation tooling deployment.

T1027Obfuscated Files or Information

Play ransomware payloads are split into multiple parts to bypass AV scanning; parts reassembled on target systems.

T1070Indicator Removal

T1070.001Indicator Removal: Clear Windows Event Logs

Windows event logs wiped to remove forensic evidence using wevtutil.

T1484Domain or Tenant Policy Modification

T1484.001Domain or Tenant Policy Modification: Group Policy Modification

T1562.001Disable or Modify Tools

Security tools including Windows Defender and AV products disabled prior to encryption.

T1003OS Credential Dumping

T1003.001OS Credential Dumping: LSASS Memory

Mimikatz and similar tools used for LSASS memory dumping to harvest credentials.

T1003.003OS Credential Dumping: NTDS

NTDS.dit extracted from domain controllers to obtain all domain account hashes.

T1552Unsecured Credentials

T1016System Network Configuration Discovery

T1046Network Service Discovery

Network scanning tools used to enumerate hosts, services, and potential lateral movement targets.

T1087.002Account Discovery: Domain Account

Active Directory enumeration to identify privileged accounts and high-value targets.

T1518Software Discovery

T1518.001Software Discovery: Security Software Discovery

T1021.001Remote Services: Remote Desktop Protocol

RDP used for lateral movement across victim networks.

T1021.002Remote Services: SMB/Windows Admin Shares

PsExec and SMB used to propagate payloads laterally.

T1570Lateral Tool Transfer

T1560Archive Collected Data

T1560.001Archive Collected Data: Archive via Utility

WinRAR used to compress and archive stolen data prior to exfiltration.

T1048Exfiltration Over Alternative Protocol

WinSCP and Rclone used to exfiltrate data to actor-controlled infrastructure and cloud storage ahead of encryption.

T1219Remote Access Software

Cobalt Strike, SystemBC, and AnyDesk used as C2 frameworks for persistent access.

T1486Data Encrypted for Impact

Play ransomware uses AES-RSA hybrid encryption. Files appended with .play extension. Targets Windows and Linux/ESXi environments. Double extortion model with data published on Play leak site. Notable for NOT including ransom note in individual encrypted files — single note left at root of C: drive.

T1489Service Stop

Database, mail, backup, and security services terminated before encryption to ensure maximum file access.

T1490Inhibit System Recovery

Shadow copies deleted and Windows recovery disabled to prevent victim restoration of files.

T1657Financial Theft