What is Play Ransomware?
The Play ransomware group, also known as PlayCrypt, has made quite a name for itself, pulling off over 300 successful attacks since June 2022. This group is notorious for its disruptive tactics, hitting big U.S. Local Gov departments like Oakland, Lowell (Massachusetts), and Dallas County, causing major disruptions and data breaches that took days to sort out. They've even gone international, sparking alerts in Switzerland after stealing data from an IT provider.
How Play Ransomware Operates?
Image 1: Play Ransomware’s Victims
Emerging in 2022, Play ransomware quickly advanced its capabilities, targeting high-value sectors with a sophisticated infrastructure of leak sites and distributed Command-and-Control (C2) servers. Its calculated approach prioritises organisations with cyber insurance, using advanced initial access techniques, lateral movement, and layered extortion tactics, such as strategic data leaks and refined negotiations, to increase ransom payment pressure.
Play employs custom encryption, anti-analysis features, and complex evasion tactics like anti-debugging and process hiding bypassing EDR protection. Often sharing infrastructure with state-sponsored actors, Play ransomware’s robust C2 network and obfuscation techniques make it highly resilient and challenging to detect.
What are the Tactics, Techniques, and Procedures (TTPs) of Play Ransomware?
- Unique Negotiation Style: Play ransomware directly contacts victims via email, avoiding upfront ransom demands. They employ "double extortion," stealing data before encrypting systems, often leveraging vulnerabilities in FortiOS and Microsoft software.
- Ransom and Extortion Tactics: Ransom demands, typically in cryptocurrency, are pressured by threats to leak data on the dark web. Victims recognise Play ransomware by the ".play" file extension, and the group uses tools to disable antivirus protection and exfiltrate data.
- State-Actor Connections: Play shows clear links to North Korean APT groups, sharing infrastructure, server configurations, and targeting methods, especially in the healthcare sector.
- Infrastructure and C2: They operate shared Command-and-Control (C2) servers, like IP 68.235.184[.]54, indicative of North Korean coordination.
- Technical and Vulnerability Exploits: Play ransomware exploits Microsoft Exchange (ProxyNotShell, OWASSRF) vulnerabilities and deploys DPRK-linked malware, mimicking tactics used by UNC4899.
- Healthcare Targeting: Prioritises healthcare organisations, often coordinating attacks across multiple victims for maximal disruption.
- Persistence and Control: Gains initial access through CVE-2022-41082 and CVE-2022-41040, deploying web shells, Cobalt Strike beacons, and PowerShell commands for persistent control.
- Lateral Movement: Uses registry modifications, scheduled tasks, and admin shares, with BitLocker encryption and Volume Shadow Copy deletion to enhance data impact.
- Advanced Tools and Evasion: Utilises custom web shells, Remote Access Tools (RATs), and North Korean malware for sophisticated access and evasion.
- Coordinated Operations: Play’s shared infrastructure and timing with DPRK actors suggest strategic collaboration, reinforcing the need for robust defence and threat intelligence.
- These TTPs illustrate Play ransomware’s complex operations and its state-linked sophistication, underlining the need for advanced security measures.