Início / Grupos de ameaça / Play
Play G1040
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
4
CVEs associadas
36
Técnicas
9
Malwares e ferramentas
Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.
Operações de ransomware ligadas a este grupo ransomware.live
playVulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
CVE-2022-41082
Alta · 8.0
KEV Ransomware Microsoft Exchange Server Remote Code Execution Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
CVE-2022-41040
Alta · 8.8
KEV Ransomware Microsoft Exchange Server Server-Side Request Forgery Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
CVE-2020-12812
Crítica · 9.8
KEV Ransomware Fortinet FortiOS SSL VPN Improper Authentication Vulnerability
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
“Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.”
Técnicas por tática
Desenvolvimento de recursos
T1587.001 MalwareT1588.002 Tool Acesso inicial
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application Execução
T1059.001 PowerShellT1059.003 Windows Command Shell Persistência
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local AccountsT1133 External Remote Services Escalada de privilégios
T1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local Accounts Furtividade
T1027.010 Command ObfuscationT1070.004 File DeletionT1078 Valid AccountsT1078.002 Domain AccountsT1078.003 Local Accounts Comprometimento de defesas
T1685 Disable or Modify ToolsT1685.005 Clear Windows Event Logs Acesso a credenciais
T1003.001 LSASS Memory Descoberta
T1016 System Network Configuration DiscoveryT1018 Remote System DiscoveryT1057 Process DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1518.001 Security Software Discovery Movimento lateral
T1021.002 SMB/Windows Admin Shares Coleta
T1560.001 Archive via Utility Comando e controle
T1105 Ingress Tool Transfer Exfiltração
T1030 Data Transfer Size LimitsT1048 Exfiltration Over Alternative Protocol Impacto
T1657 Financial Theft Malwares e ferramentas
- Cobalt StrikeMalwareS0154
- PlaycryptMalwareS1162
- AdFindFerramentaS0552
- BloodHoundFerramentaS0521
- EmpireFerramentaS0363
- MimikatzFerramentaS0002
- NltestFerramentaS0359
- PsExecFerramentaS0029
- WevtutilFerramentaS0645
© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.