DECODING GRIXBA — A PLAY RANSOMWARE SCANNER

Play Ransomware's in-house infostealer 'Grixba' (four samples across 26 months) performs broad host and credential reconnaissance prior to encryption; the report documents version-specific features (v1 → v1.5 → v2 → v3), IOCs (hashes, drop path, mutex, PIA VPN IP), persistent behaviors (WMI/WinRM enumeration, event log clearing), detection/evasion trade-offs, and operational weaknesses defenders can exploit.