Play to win, pay to lose.

Play (PlayCrypt) ransomware continues to target organizations across multiple sectors using a double-extortion model: gaining initial access (reported via SonicWall VPN compromise), moving laterally with tools like Mimikatz and PsExec, exfiltrating sensitive data, and disabling endpoint protection by leveraging the victim's SentinelOne uninstallation utility; the research calls out specific TTPs and IOC-worthy behaviors such as SYSVOL staging, SystemBC C2, event log clearing, and suspicious WinSCP usage.