play
First seen November 26, 2022Active1,342 claimed victims
The claims below are reproduced as posted by play on its own leak site. Such claims are frequently wrong or exaggerated, and are unverified. Organisations listed here have not been confirmed to have suffered a breach.
Listed organisation? Contact [email protected].
Profile
Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises. On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network.
Description from ransomware.live.
Claimed victims (as posted by the group — unverified)
| Victim (as posted) | Claimed on | Source | Press coverage |
|---|---|---|---|
| SUNY Polytechnic Institute | January 3, 2023 | ransomware_live | — |
| Sirius Shipping | January 3, 2023 | ransomware_live | — |
| Tarntank Ship Management | January 3, 2023 | ransomware_live | — |
| S??? | January 2, 2023 | ransomware_live | — |
| Stratacache | January 2, 2023 | ransomware_live | — |
| CDER | January 1, 2023 | ransomware_live | — |
| FURETANK,SIRIUS SHIPPING,VAS,DONSONET | December 27, 2022 | ransomware_live | — |
| F???????, ???, D????????, T???????, S????????????? | December 22, 2022 | ransomware_live | — |
| Cervecería Regional | December 22, 2022 | ransomware_live | — |
| S?????????? | December 18, 2022 | ransomware_live | — |
| Creta Farm | December 18, 2022 | ransomware_live | — |
| C???e????? ????????????? | December 18, 2022 | ransomware_live | — |
| H-Hotels | December 18, 2022 | ransomware_live | — |
| OPUS IT Services | December 18, 2022 | ransomware_live | — |
| JMicron | December 16, 2022 | ransomware_live | — |
| Arsat | December 16, 2022 | ransomware_live | — |
| Cetrogar | December 13, 2022 | ransomware_live | — |
| VFS | December 13, 2022 | ransomware_live | — |
| Antwerpen | December 11, 2022 | ransomware_live | — |
| Una Seguros | December 11, 2022 | ransomware_live | — |
| Hilldrup | December 9, 2022 | ransomware_live | — |
| ??????? | December 9, 2022 | ransomware_live | — |
| ???? | December 8, 2022 | ransomware_live | — |
| ????????? ???? ????? | December 7, 2022 | ransomware_live | — |
| UJV Rez | December 7, 2022 | ransomware_live | — |
| Wrota Mazowsza | December 7, 2022 | ransomware_live | — |
| Highwater Ethanol | December 7, 2022 | ransomware_live | — |
| MME Group | December 7, 2022 | ransomware_live | — |
| Skoda Praha | December 7, 2022 | ransomware_live | — |
| CIBTvisas | December 6, 2022 | ransomware_live | — |
| Austria Presse Agentur | December 5, 2022 | ransomware_live | — |
| ??? | November 29, 2022 | ransomware_live | — |
| ???? ????? | November 28, 2022 | ransomware_live | — |
| ??????????? | November 28, 2022 | ransomware_live | — |
| Verity cloud | November 28, 2022 | ransomware_live | — |
| Origin Property Company Limited | November 26, 2022 | ransomware_live | — |
| Conseil departemental - Alpes-Maritimes | November 26, 2022 | ransomware_live | — |
| Itsgroup | November 26, 2022 | ransomware_live | — |
| Ministry of Transport and Public Works | November 26, 2022 | ransomware_live | — |
| Alcomet | November 26, 2022 | ransomware_live | — |
| Leadtek | November 26, 2022 | ransomware_live | — |
| PVFCCo | November 26, 2022 | ransomware_live | — |
← NewerPage 14 of 14
Claim data from ransomware.live and RansomLook (CC BY 4.0).