Malware: Playcrypt

Description

[Playcrypt](https://attack.mitre.org/software/S1162) is a ransomware that has been used by [Play](https://attack.mitre.org/groups/G1040) since at least 2022 in attacks against against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. [Playcrypt](https://attack.mitre.org/software/S1162) derives its name from adding the .play extension to encrypted files and has overlap with tactics and tools associated with Hive and Nokoyawa ransomware and infrastructure associated with Quantum ransomware.(Citation: Microsoft PlayCrypt August 2022)(Citation: CISA Play Ransomware Advisory December 2023)(Citation: Trend Micro Ransomware Spotlight Play July 2023)

External References

• mitre-attack
• CISA Play Ransomware Advisory December 2023
• Microsoft PlayCrypt August 2022
• Trend Micro Ransomware Spotlight Play July 2023

Techniques Used by This Malware

• T1083 — File and Directory Discovery
• T1486 — Data Encrypted for Impact
• T1490 — Inhibit System Recovery

APT Groups Using This Malware

• Play