Home / Threat actors / Play
Play G1040
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
4
associated CVEs
36
Techniques
9
Malware and tools
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.
Ransomware operations linked to this group ransomware.live
playExploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
CVE-2022-41082
High · 8.0
KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
CVE-2022-41040
High · 8.8
KEV Ransomware Microsoft Exchange Server Server-Side Request Forgery Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
CVE-2020-12812
Critical · 9.8
KEV Ransomware Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
Techniques by tactic
Resource Development
T1587.001 MalwareT1588.002 Tool Initial Access
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application Execution
T1059.001 PowerShellT1059.003 Windows Command Shell Persistence
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1133 External Remote Services Privilege Escalation
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local Accounts Stealth
T1027.010 Command ObfuscationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local Accounts Defense Impairment
T1685 Disable or Modify ToolsT1685.005 Clear Windows Event Logs Credential Access
T1003.001 LSASS Memory Discovery
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518.001 Security Software Discovery Lateral Movement
T1021.002 SMB/Windows Admin Shares Collection
T1560.001 Archive via Utility Command and Control
T1105 Ingress Tool Transfer Exfiltration
T1030 Data Transfer Size LimitsT1048 Exfiltration Over Alternative Protocol Impact
T1657 Financial Theft Malware and tools
- Cobalt StrikeMalwareS0154
- PlaycryptMalwareS1162
- AdFindToolS0552
- BloodHoundToolS0521
- EmpireToolS0363
- MimikatzToolS0002
- NltestToolS0359
- PsExecToolS0029
- WevtutilToolS0645
© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.