Play (also called PlayCrypt) is a prolific ransomware operation active since 2022, known for double extortion and attacks on businesses and government and critical-infrastructure entities.

Key facts

• Uses double extortion, exfiltrating data before encryption and threatening to publish it.
• Frequently gains access through exposed services, valid accounts and unpatched vulnerabilities.
• Has targeted local government, critical infrastructure and mid-sized enterprises across multiple regions.
• Subject of joint advisories highlighting its custom tooling and intermittent-encryption techniques.

Why it matters

Play favours the same entry points DarkThreatX surfaces: exposed credentials and accounts. Early detection of those exposures closes the door before Play can use it.

How DarkThreatX helps

DarkThreatX monitors dark web leak sites, forums and marketplaces for activity and data tied to your organisation, so you can respond before exposure becomes a breach. Run a free dark web scan or explore the platform.