Jumpy Pisces Engages in Play Ransomware

**Executive Summary:** Unit 42 attributes a May–September 2024 intrusion to North Korean state-sponsored group Jumpy Pisces that used Sliver and DTrack to maintain access and perform credential harvesting and lateral movement, after which Play ransomware was deployed; the report documents tooling, indicators (SHA256 hashes, C2 IP 172.96.137.224, domain americajobmail.site, and code-sign certificate details), and assesses a likely collaboration or initial-access brokering relationship between Jumpy Pisces and Play ransomware actors.