S1162 Playcrypt

malwareEnterprise

platformsWindows

also known asPlaycrypt · Play

Playcrypt is a ransomware that has been used by Play since at least 2022 in attacks against against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Playcrypt derives its name from adding the.play extension to encrypted files and has overlap with tactics and tools associated with Hive and Nokoyawa ransomware and infrastructure associated with Quantum ransomware.

techniques used (3)

ATT&CK techniques this enables or maps to.

T1083File and Directory Discovery
T1486Data Encrypted for Impact
T1490Inhibit System Recovery

used by groups (1)

Threat groups associated with this.

G1040Play

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan