play

Play ransomware (also known as PlayCrypt) emerged in mid-2022 and is characterized by its use of the ".play" file extension and a minimalist ransom note that simply reads "PLAY." The group exploits vulnerabilities in Fortinet products and Microsoft Exchange (ProxyNotShell) for initial access and is known for targeting government entities, critical infrastructure, and professional services in the US, Latin America, and Europe. Play is believed by some researchers to have links to the Hive and Nokoyawa ransomware operations based on shared TTPs and infrastructure.