North Korean govt hackers linked to Play ransomware attack

**Unit 42 links North Korea’s Andariel to a Play ransomware incident:** Andariel gained initial access in May 2024 via a compromised account, performed credential harvesting (Mimikatz), deployed Sliver C2 and DTrack across hosts, removed EDR and persisted, and the Play ransomware encryptor was executed in September 2024; researchers assess a likely connection (affiliate or IAB) and note this model helps sanctioned actors evade restrictions.