FBI Released TTPs & IoCs Play Ransomware That Compromise 900+ Organizations

The Federal Bureau of Investigation (FBI), in partnership with the Cybersecurity and Infrastructure Security Agency (CISA) and Australia’s ASD’s ACSC.

It has released a comprehensive technical advisory detailing the Tactics, Techniques, and Procedures (TTPs) along with Indicators of Compromise (IoCs) associated with the Play ransomware group a threat collective responsible for compromising over 900 organizations across North America, South America, and Europe as of May 2025.

First identified in June 2022 and exhibiting heightened activity throughout 2024, Play (also tracked as Playcrypt) ransomware has become one of the most prolific cyber extortion groups in recent years.

Notably, the group employs a double extortion model, exfiltrating sensitive data before encrypting victims’ systems, and subsequently threatening public data release if their demands are not met.

The group’s operational secrecy is maintained via closed communication channels victims are instructed to contact unique @gmx.de or @web.de addresses, and in some cases, are even phoned and threatened to expedite payment.

Technical Attack Chain and TTPs

Play ransomware’s initial access typically leverages valid account abuse (often via credentials purchased on the dark web) and exploitation of public-facing applications.

High-profile vulnerabilities targeted include FortiOS (CVE-2018-13379, CVE-2020-12812) and Microsoft Exchange (ProxyNotShell: CVE-2022-41040, CVE-2022-41082).

Recent attacks have also exploited CVE-2024-57727 in the SimpleHelp remote monitoring tool, with attackers using RDP and VPN for network entry.

Upon access, Play actors conduct discovery using utilities like AdFind and Grixba for Active Directory reconnaissance and anti-virus detection.

For defense evasion, tools such as GMER, IOBit, and PowerTool are deployed to disable endpoint protection and clear event logs.

Lateral movement is facilitated through Cobalt Strike, SystemBC, and PsExec, with credential escalation via Mimikatz and privilege enumeration by WinPEAS.

According to the Report, Data exfiltration is performed using WinRAR for data compression and WinSCP for transfer to attacker-controlled infrastructure.

Encryption utilizes an AES-RSA hybrid technique, appending a .PLAY extension and skipping system files to ensure operational impact while maintaining ransom leverage.

Specific Tactics

Beyond Windows environments, Play ransomware’s ESXi variant employs custom shell commands, powers down virtual machines, and encrypts VMware-related files with AES-256.

Each deployment is uniquely recompiled to evade signature-based detection, further complicating incident response.

The ESXi variant supports campaign-specific flags and places ransom notes both in system directories and as ESXi welcome messages, underscoring the group’s technical sophistication.

The FBI, CISA, and ACSC strongly urge organizations to implement multifactor authentication, prioritize patching of known exploited vulnerabilities, maintain segmented and regularly backed-up infrastructure, and strengthen password policies.

Detection should focus on anomalous use of legitimate tools (e.g., PsExec, Cobalt Strike, AdFind), unauthorized data compression or transfer activity, and custom binaries with IoCs outlined below.

Indicators of Compromise (IoCs)

Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Update