play
ACTIVEransomware group
Play ransomware (also known as PlayCrypt) emerged in mid-2022 and is characterized by its use of the ".play" file extension and a minimalist ransom note that simply reads "PLAY." The group exploits vulnerabilities in Fortinet products and Microsoft Exchange (ProxyNotShell) for initial access and is known for targeting government entities, critical infrastructure, and professional services in the US, Latin America, and Europe. Play is believed by some researchers to have links to the Hive and Nokoyawa ransomware operations based on shared TTPs and infrastructure.
Group Activity
Last 12 monthsVictims (1292)
Benchmark Industrial Supply
Greg Crosslin
United States
Integrated Technologies
United States
eurOptimum
United States
Mundt and Associates
United States
Rainbow Distributors USA
United States
Pearson Ford
United States
Urschel Laboratories
United States
Dallis Law Firm
United States
The Chapel
United States
Corley MFG
United States
Digitall Graphics
Canada
Hightower Communications
United States
GW Mechanical
United States
NL Fisher
Canada
Round Hill Country Club
United States
Legend Networking & Telecom
United States
MyPillow
United States
De Waard Transport
Netherlands
Zuther Hautmann
United States
ACC Construction
United States
IWC Food Service
United States
Ashcroft Homes
Canada
DURAND-WAYLAND
United States
Infoworld Membership Systems
United States
Town Car International
United States
Northern Mechanical Contractors
United States
EMA Engineering & Consulting
United States
K & E Distributing
United States
Accessoires Outillage Ltee
Canada
Crystal Point
United States
Morphosis
United States
Barnes Solicitors LLP
United Kingdom
Sokolin
United States
convexx.com
Irwin Car United States www.irwincar.com 👁️ views: 24227 added: 2025-11-03 publication date: 2025-11-07 PUBLISHED FULL
Brokk
Sweden
Colorado Construction
United Kingdom
Lucky Look
Germany
Weber Kracht & Chellew
United States
Specflue
United Kingdom
Kivells
United Kingdom
Dock Pros
United States
Ampex Data Systems
United States
Valley Plating Inc
United States
Witt UK Group
United Kingdom
TPIS Industrial Services
United States
aphaseii.com
Fast Freight Canada www.fastfreightinc.com 👁️ views: 23283 added: 2025-10-28 publication date: 2025-10-31 PUBLISHED FULL
encorerepair.com
Professional's Choice Sports United States www.profchoice.com 👁️ views: 23029 added: 2025-11-01 publication date: 2025-11-04 PUBLISHED FULL
irwincar.com
Wright Tool United States www.wrighttool.com 👁️ views: 23239 added: 2025-11-01 publication date: 2025-11-04 PUBLISHED FULL
All Real Estate Title Solutions
United States
Infrastructure
http://b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion1809ms
49m ago
http://j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion4763ms
49m ago