Play
Play, also known as Playcrypt and referred to in aliases as Balloonfly, is a ransomware group operating a double-extortion model. The content states that Play significantly increased victim postings in Q4 2023 and remained among the most active ransomware groups through 2025 and Q1 2026, with broad victimization concentrated in the United States and additional victims across Canada, Europe, Asia-Pacific, Africa, Latin America, and the Caribbean. The group has targeted multiple sectors, including healthcare, manufacturing, construction, professional services, government-related entities, and critical infrastructure. The FBI reporting cited in the content says Play operators had allegedly impacted about 900 organizations by May 2025, and the variant consistently ranked among the top threats to critical infrastructure. The content states that Play tends to gain initial access by exploiting known public-facing vulnerabilities, including FortiOS flaws, and also uses valid accounts. Reported tradecraft includes scheduled tasks; PowerShell, including Base64-encoded PowerShell used to disable Microsoft Defender; credential dumping from LSASS and NTDS; discovery of system, network, software, security software, and domain account information; remote services including RDP and SMB/Windows Admin Shares for lateral movement; lateral tool transfer; data archiving and exfiltration over alternative protocols; remote access software for command and control; clearing Windows event logs; stopping services; inhibiting system recovery; modifying group policy or tenant policy; disabling or modifying security tools; and encrypting data for impact. Specific tools and procedures mentioned include use of Grixba to check for security processes; batch scripts to remove indicators of presence; AdFind, Nltest, and BloodHound for network enumeration; GMER, IOBit, and PowerTool to disable antivirus; Wevtutil for artifact removal; and WinSCP command-line transfers for exfiltration in some intrusions. The content also states that Play instructs victims to contact the group by email rather than providing direct payment instructions in ransom notes. Associated artifacts mentioned in the content include a YARA rule named "Play.yar" and the email IOCs derdiarikucisv@gmx.de and raniyumiamrm@gmx.de. The content further notes that Play has used a Babuk-based ESXi encryptor and that ESET reported links between Play, RansomHub, Medusa, and BianLian through shared affiliate tooling, with one affiliate cluster assessed by ESET as most closely resembling Play operations. Separately, the content states that North Korean government actors have used Play ransomware in their intrusions, but it does not attribute Play itself as a North Korean state actor.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Targeting
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Who they target
Sectors the actor has been observed targeting.
- Health Care Equipment & Services
- Government & Administration
Where they target
Geographies tied to known operations.
- 🇺🇸 United States
Tradecraft
59 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
10 malware families attributed to this actor across reporting.
5 additional families tracked in Mallory.
Associated vulnerabilities
14 CVEs this actor has used in observed campaigns. 14 of them exploited in the wild.
Play Ransomware Attack Exploited CVE-2025-29824 as a 0-Day — ... leveraged CVE-2025-29824, a privilege escalation flaw in the Common Log File System (CLFS) driver that was patched by Microsoft last month. That said, no ransomware was actually deployed in the attack. However, Grixba... was put to use.
Ember Bear ... CVE-2022-41040 ... in Microsoft Exchange... Play ... CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.
Play has exploited known vulnerabilities for initial access including ... CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.
Agrius exploits public-facing applications for initial access to victim environments. Examples include widespread attempts to exploit CVE-2018-13379 in FortiOS devices... APT29 has exploited ... CVE-2018-13379 for FortiGate VPNs... Dragonfly ... exploited ... CVE-2018-13379 for Fortinet VPNs... Magic Hound ... exploited ... Fortios SSL VPNs (CVE-2018-13379). Play ... including CVE-2018-13379 ... in FortiOS.
Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS
9 more CVEs tied to this actor tracked in Mallory.
Observables
55 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Conducting ransomware and extortion operations, including alleged data theft from MyPillow, prior theft of Swiss government files via Xplain, and attacks affecting Microchip Technology. The content also notes Play as a top ransomware threat targeting critical infrastructure.
Ransomware intrusion activity involving initial access, credential access, discovery, lateral movement, collection, exfiltration, command and control, and impact across many organizations. The content associates Play with exploitation of public-facing applications, credential dumping, remote services abuse, PowerShell execution, defense evasion, and ransomware encryption.
Named as one of five ransomware operators publishing new victims on DLS infrastructure in a single day as part of the fragmented 2026 RaaS landscape.
Closed-group ransomware operation with strong US targeting bias and centralized target selection.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.