play Ransomware

No MITRE ATT&CK MITRE ATT&CK

Perfil do grupo: Play (G1040)

Initially observed in June 2022, the Play ransomware (a.k.a PlayCrypt) operates through double extortion, targeting numerous organizations in Latin America. Its Initial Access method is quite similar to other ransomwares, involving attacks such as Phishing, Exposed Services to the Internet, and Valid Account compromises.

On April 19, 2023, the security company Symantec published two new tools developed by the Play group. These tools allow the malicious actor to enumerate and exfiltrate data from the internal network. The post mentions the following: 'Play threat actors use the .NET infostealer to enumerate software and services via WMI, WinRM, Remote Registry, and Remote Service. The malware checks for the existence of security and backup software, as well as remote administration tools and other programs, saving the information in .CSV files that are compressed into a .ZIP file for later manual exfiltration by threat actors.'Source: https://github.com/crocodyli/ThreatActors-TTPs

Vulnerabilidades citadas para este grupo

CVEs associadas ao grupo pelo ransomware.live. Fichas ainda não publicadas aparecem sem link.

• CVE-2022-41082 Alta · 8.0 KEV Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-41040 Alta · 8.8 KEV Microsoft Exchange Server Server-Side Request Forgery Vulnerability
• CVE-2018-13379 Crítica · 9.8 KEV Fortinet FortiOS SSL VPN Path Traversal Vulnerability