Podcasts
Play
Active Since
June 2022
Total Victims as of January 2024
328
Known Forum Aliases
N/A
Active Forum Accounts
N/A
Top Targeted Geographies
US, UK, Canada
Play ransomware is named after the “.play” extension it appends to the files it encrypts.
It has been noted that tactics used by Play are shared by fellow ransomware campaigns Nokoyawa and Hive, suggesting a connection between the operations. There is also indication that Play ransomware shares some of the infrastructure to stage its attacks with Quantum RaaS.
Play keeps a fairly low profile on the dark web aside from its leak site, not advertising via forum accounts and recently had to fend off accusations it had introduced a RaaS model. The gang claims on its site to be a closed group to “guarantee the secrecy of deals”.
Related Content
The Dark Web Hub
8Base
8Base uses a variant of Phobos ransomware, modified to append a ".8base" extension. Researchers have also noted that 8Base's leak site bears similarities to the data extortion operation RansomHouse.
The Dark Web Hub
Akira
Akira appears to be a novel ransomware, written in C++, with versions targeted both at Windows machines and Linux operating systems. It has quickly become one of the most prolific ransomware groups.
The Dark Web Hub
BlackBasta
BlackBasta is a ransomware operation that is notable for its high volume of attacks, use of custom tools, and suspected links to cybercriminal group FIN7.
The Dark Web Hub
BlackCat [offline]
The RaaS group BlackCat (also known as ALPHV or Noberus) is believed to include developers and money launderers from the former DarkSide ransomware group, most infamous for the Colonial Pipeline attack.
The Dark Web Hub
Cl0p
Cl0p is notable for its approach of using vulnerabilities in supply chain software to target multiple organizations, announcing them in a batch at a later date.
Videos
