Play

Play, also known as PlayCrypt and tracked by Symantec as Balloonfly, is a ransomware operation first observed in June 2022. It is widely characterized as a ransomware-as-a-service ecosystem and is known for double-extortion operations in which data is stolen prior to encryption and later threatened with publication on a leak site if the victim does not pay. The group has been associated with big-game hunting as well as attacks against small and medium-sized organizations, managed service providers, government entities, and other high-value enterprise targets. Play has repeatedly exploited public-facing enterprise infrastructure for initial access, including Microsoft Exchange vulnerabilities such as CVE-2022-41080 and CVE-2022-41082 and Citrix NetScaler flaws including CVE-2023-4966 (Citrix Bleed). Intrusions have also involved access through valid VPN credentials. Post-compromise activity includes rapid internal reconnaissance, enumeration of domain accounts, trusted domains, permission groups, remote systems, and security tooling, followed by lateral movement and fast ransomware deployment, sometimes within a single day. Manual deployment via RDP and remote execution via PsExec have been observed. The operation uses custom tooling to accelerate post-exploitation and defense evasion. A notable example is Grixba, a .NET information-gathering and network-scanning tool used to enumerate users, computers, software, services, security products, backup tools, and remote administration software across victim environments. Grixba can also clear logs locally and remotely. Play operators have also used a custom tool based on AlphaVSS to copy files from Volume Shadow Copy Service snapshots, enabling access to locked files before encryption. The group has been observed using AdFind for directory and Active Directory reconnaissance and has used DNS-based PowerShell command-and-control patterns reflected in ATT&CK mappings associated with the actor. Play is known for intermittent or partial encryption, encrypting only portions of files to increase speed and reduce opportunities for detection. Reported intrusions also show exfiltration of collected data prior to encryption and publication of stolen material on the group’s leak infrastructure. The actor has targeted organizations in North America and Europe at significant scale, with earlier reporting also noting an initial focus on Latin America, especially Brazil. Victim sectors directly associated with Play activity include healthcare, information technology and IT manufacturing, education, professional services, government, and industrial organizations. The group remains one of the more active ransomware brands in recent reporting, with sustained victim volumes across 2023 through 2026 and continued use of vulnerability exploitation, credential-based access, reconnaissance, lateral movement, exfiltration, encryption, and extortion.