play
Known ransomware group ACTIVEAlso known as: PlayCrypt
Currently active
Play (PlayCrypt) is a ransomware group active since mid-2022, notable for intermittent-encryption techniques and for appending the ".play" extension to encrypted files. It has hit government, IT, and critical-infrastructure targets worldwide and runs a double-extortion leak site.
1
Total Claims
0
Critical
—
Records Claimed
1
Industries Hit
Active span: Jun 6, 2026 – Jun 6, 2026 · 1 organizations targeted
Currently active
Actor Threat Profile
Activity Timeline
Peak: Jun 2026 (1)Jun 2026
LessMore
Jun 2026Share this profile
Top Targeted Industries
Transportation/Logistics 1
Tradecraft & Infrastructure
16
Documented tools
10 / 31
MITRE tactics / techniques
3
Known leak sites
CredentialTheftDefenseEvasionDiscoveryEnumExfiltrationLOLBASNetworkingOffsec
Full intelligence profile on ransomware.live →