Double-Extortion Play Ransomware Strikes 300 Organizations Worldwide

This advisory summarizes activity attributed to the Play ransomware operation (aka Balloonfly/PlayCrypt), which emerged in 2022 and has affected roughly 300 organizations by October 2023. Play leverages exploited vulnerabilities in Microsoft Exchange and Fortinet appliances, uses a double-extortion RaaS model with data exfiltration followed by encryption, and employs public and bespoke tools (AdFind, Grixba, Cobalt Strike, Mimikatz, etc.) to disable defenses, move laterally, and harvest backups and credentials. The report also situates Play among contemporaneous ransomware groups and trends, including collaboration between gangs, the rise of RaaS, and shifts toward vulnerability-based initial access.