Fiddling Scorpius

Fiddling Scorpius is identified in the provided content as the threat group behind the Play ransomware operation, as tracked by Palo Alto. The content links the group to Play ransomware activity, including the reported attack on the French Rugby Federation three months before the 2023 Rugby World Cup, where systems were encrypted and personally identifiable information was exfiltrated. Play ransomware, also known as PlayCrypt, has been active since at least June 2022 and uses double extortion, combining encryption with data theft and leak-site pressure. Reported initial access methods associated with the operation include valid account abuse, exploitation of public-facing applications such as FortiOS SSL VPN and Microsoft Exchange, phishing and social engineering, and abuse of external remote services including RDP and VPN. The malware is described as written in C++, with anti-debugging and anti-analysis features, and reporting indicates binaries may be recompiled per victim to generate unique hashes. A Linux variant targeting VMware ESXi environments has also been reported. The content also notes commonly reported associations involving the broader Play operation, including Andariel, Balloonfly, Prolific Puma, QuadSwitcher, and Quantum, but does not establish confirmed relationships. Known alias for this actor in the provided content is Fiddling Scorpius; the associated ransomware family is Play, also known as PlayCrypt.