Executive Summary
Play — also tracked as PlayCrypt, Balloonfly, or occasionally Safeplay — has been active since at least June 2022 and shows no sign of stopping, with leak-site claims as recent as October 4, 2026. What makes it worth a closer look isn’t novelty of technique; it’s two open questions that the public record still hasn’t resolved. First, how the group actually operates: CISA, the FBI, and Australia’s ACSC describe it as a closed, private group that controls negotiations directly, while a lone November 2023 vendor report (Adlumin) argued it had shifted toward a ransomware-as-a-service affiliate model — a claim that hasn’t been independently corroborated since. Second, whether a 2025 Windows zero-day used in a Play-linked intrusion is the same activity Microsoft separately tracks under a different name. Neither question is settled, and this piece treats both as open rather than picking a side.
Operating Model: Closed Group or RaaS? Unresolved
The clearest statement on record comes from Play’s own leak site, which claims to operate in secrecy and asserts it handles negotiations directly rather than through a franchised affiliate network — and CISA’s advisory, along with most vendor reporting, generally accepts that closed-group characterization. Adlumin’s November 2023 report broke from that consensus, describing indicators consistent with a shift toward a RaaS or affiliate structure. No later vendor report reviewed for this piece independently confirmed Adlumin’s claim, and CISA’s most recent advisory update (June 2025) does not revise its characterization of the group’s structure. Readers should treat the operating model as genuinely unresolved rather than assume either description is current.
How Intrusions Happen
CISA’s advisory describes initial access through purchased valid accounts and exploitation of known vulnerabilities in FortiOS (CVE-2018-13379, CVE-2020-12812) and Microsoft Exchange via the ProxyNotShell chain (CVE-2022-41040 and CVE-2022-41082), plus abuse of external remote services generally. The June 2025 update added a new wrinkle: initial-access brokers linked to Play have been observed chaining three SimpleHelp remote monitoring and management vulnerabilities — CVE-2024-57727, CVE-2024-57726, and CVE-2024-57728 — to gain footholds, reflecting the broader trend of ransomware operators increasingly relying on compromised RMM software as an entry point.
Once inside, the toolkit is fairly conventional for a group this size: AdFind, Grixba, BloodHound, and Nltest for reconnaissance; GMER, IOBit, PowerTool, and PowerShell-based techniques to blind or disable Defender and other security tooling; Cobalt Strike, SystemBC, PsExec, and Plink for lateral movement; Mimikatz and WinPEAS for credential access; and WinRAR or WinSCP for staging and exfiltration. The encryptor itself is distinctive on a technical level — it uses a hybrid AES-RSA scheme with intermittent encryption, encrypting roughly every other megabyte-sized chunk rather than full files, which speeds up the attack and can make some forms of statistical detection less reliable. Encrypted files get a .PLAY extension. Since the June 2025 advisory update, CISA also documents an ESXi-targeting variant that uses AES-256 and powers off running virtual machines before encrypting their datastores — a now-standard move for ransomware groups going after virtualized server infrastructure directly. Notably, the binary itself is reportedly recompiled for each attack, which complicates hash-based detection across incidents.
The Extortion Style
Play’s ransom note is unusual in what it leaves out. There’s no stated ransom amount, no payment instructions, and critically, no link to a standard negotiation chat portal — the format most ransomware groups have standardized on. Instead, victims are instructed to email an address on a free webmail provider, typically gmx.de or web.de, and some victims have reported follow-up contact by phone. Non-payment leads to publication on the group’s Tor-based leak site. This lo-fi, email-first communication style is one of the more consistent fingerprints for attributing an intrusion to Play specifically, separate from the technical toolkit.
The CVE-2025-29824 Question
In 2025, Symantec reported that actors it tracks as Balloonfly — its name for the Play-affiliated cluster — exploited CVE-2025-29824, a Windows Common Log File System zero-day, via a compromised Cisco ASA device. Microsoft patched the flaw on April 8, 2025, and it was added to CISA’s Known Exploited Vulnerabilities catalog. In the specific intrusion Symantec analyzed, the actors deployed Grixba for reconnaissance but did not deploy a ransomware payload — meaning this particular incident is evidence of pre-ransomware tooling and access, not a confirmed Play ransomware deployment via this CVE. Separately, Microsoft tracks a different cluster, “Storm-2460,” that used the same CVE-2025-29824 vulnerability to deliver a backdoor called PipeMagic. Symantec’s own writeup explicitly states that Storm-2460 is not the same activity as the Balloonfly/Play intrusion it analyzed — they are two different clusters that happened to use the same zero-day around the same time. At least one secondary report conflated the two, describing Storm-2460 simply as “the Play ransomware group.” That conflation is not supported by Symantec’s own distinction and should be treated as incorrect or at minimum unconfirmed.
Scale and Targets
CISA’s advisory describes victims as “a wide range of businesses and critical infrastructure” across North America, South America, and Europe, without providing a sector-by-sector breakdown in the advisory text itself. Leak-site claims through 2026 — none of which are independently confirmed breaches, just the group’s own assertions — have named organizations including Esquire Brands, Garner Foods and its Texas Pete brand, Locati Architects, United Infrastructure, Record Go Alquiler, Western Construction, Greg Crosslin, and a cluster tied to Cambridge Management, The Butcher Brothers, and Sigma Plastics Group. The most recent claim identified for this piece, Silicon Valley Glass, was posted October 4, 2026. None of these have independent third-party confirmation beyond the leak site itself in the sources reviewed, and should be reported as claims, not established breaches.
Status, Late 2026
No confirmed arrest, sanction, or indictment specifically naming Play as a group was identified through this writing — CISA’s AA23-352A, last updated June 4, 2025, remains the authoritative advisory. A July 2026 DOJ indictment involving bulletproof hosting infrastructure and a July 2026 Treasury sanctions action both surfaced in research for this piece, but neither source available directly confirms a Play-specific connection; any link between those actions and Play should be verified against primary court or Treasury documents before being reported as established, which this piece has not done.
What This Means
Play’s persistence since 2022, combined with the apparent absence of any disruption action specifically targeting it, puts it in a different category from recently-takedown groups like 8Base. Its unconventional extortion communication style — no stated price, no standard chat portal, webmail-only contact — is worth building into detection and response playbooks as a distinguishing signature. And the Storm-2460/Balloonfly conflation around CVE-2025-29824 is a useful reminder generally: shared CVE usage by two actors in the same rough timeframe is not evidence they’re the same actor, even when secondary reporting treats it that way.