Nation-State high Unattributed to a specific state or region

Play

CISA/FBI/ACSC and most vendors describe Play as a closed, private group that controls negotiations directly, per the group's own leak-site statement. A single November 2023 Adlumin report argued it had shifted toward a RaaS/affiliate model — not independently corroborated since. Operating model is unresolved. · Financial — double extortion

Reports 1

Active Since June 2022

Last Reported 18 Sept 2026

Sectors Targeted professional-services, manufacturing, critical-infrastructure, construction

Tactics, Techniques & Procedures (TTPs)

Initial access via purchased valid accounts; FortiOS (CVE-2018-13379, CVE-2020-12812); ProxyNotShell (CVE-2022-41040/41082)
Since June 2025: SimpleHelp RMM chain (CVE-2024-57727/57726/57728) via initial-access brokers
AdFind, Grixba, BloodHound for recon; GMER/IOBit/PowerTool to blind security tools
Hybrid AES-RSA encryption with intermittent (every-other-chunk) encryption, .PLAY extension; binary recompiled per attack
ESXi variant (added June 2025): AES-256, powers off VMs before encrypting datastores
Distinctive extortion: no ransom amount or negotiation portal in the note — victims emailed to a gmx.de/web.de address

Known Targets

Wide range of businesses and critical infrastructure, North/South America and Europe (per CISA)Leak-site claims (unverified): Esquire Brands, Garner Foods/Texas Pete, Locati Architects, Silicon Valley Glass (Oct 2026)

Analyst Notes

Still active through October 2026; no confirmed arrest, sanction, or indictment specifically naming Play identified. Symantec reported Play-affiliated actors (as Balloonfly) used CVE-2025-29824 via a compromised Cisco ASA, deploying Grixba but no ransomware payload in that intrusion. Microsoft's unrelated 'Storm-2460' cluster used the same CVE to deliver the PipeMagic backdoor; Symantec explicitly distinguishes Storm-2460 from the Play intrusion it analyzed, though at least one secondary report conflates the two — treat 'Storm-2460 = Play' as unconfirmed.

Also Known As

PlayCryptBalloonfly (Symantec)SafeplayMITRE group G1040

MITRE ATT&CK Techniques

T1078 Valid Accounts T1190 Exploit Public-Facing Application T1566 Phishing T1562.001 Impair Defenses: Disable or Modify Tools T1486 Data Encrypted for Impact T1490 Inhibit System Recovery

Intelligence Reports

Analysis professional-servicesmanufacturing

Play Ransomware Doesn't Negotiate Like Anyone Else — and It's Still Running

No ransom amount in the note, no negotiation chat portal, just a Gmail-style address and a deadline. Play has stayed active since mid-2022 with no confirmed law enforcement disruption, and its operating model is still disputed among the researchers tracking it.

18 Sept 2026 · 8 min read