#StopRansomware: Play Ransomware

Text acquired from the source

Cybersecurity Advisory #StopRansomware: Play Ransomware Last Revised June 04, 2025 Alert Code AA23-352A Related topics: Cyber Threats and Response , Malware, Phishing, and Ransomware , Cybersecurity Best Practices Summary Note: This joint Cybersecurity Advisory is part of an ongoing #StopRansomware effort to publish advisories for network defenders that detail various ransomware variants and ransomware threat actors. These #StopRansomware advisories include recently and historically observed tactics, techniques, and procedures (TTPs) and indicators of compromise (IOCs) to help organizations protect against ransomware. Visit stopransomware.gov to see all #StopRansomware advisories and to learn more about other ransomware threats and no-cost resources. Note: Updates to this advisory, originally published December 18, 2023, include: June 4, 2025: The advisory was updated to reflect new TTPs employed by Play ransomware group, as well as provide current IOCs/remove outdated IOCs for effective threat hunting. Update June 4, 2025: The Federal Bureau of Investigation (FBI), Cybersecurity and Infrastructure Security Agency (CISA), and Australian Signals Directorate’s Australian Cyber Security Centre (ASD's ACSC) are releasing this joint advisory to disseminate the Play ransomware group’s IOCs and TTPs identified through FBI investigations as recently as January 2025. End Update Since June 2022, the Play (also known as Playcrypt) ransomware group has impacted a wide range of businesses and critical infrastructure in North America, South America, and Europe. Play ransomware was among the most active ransomware groups in 2024. Organizations should take the following actions today to mitigate cyber threats from Play ransomware: Prioritize remediating known exploited vulnerabilities.