RANSOMWARE FAMILY
Play
Play, also referred to as PlayCrypt, is a ransomware group that has frequently gained access through exposed VPN and remote desktop systems before encrypting files and threatening to leak stolen data. It has targeted both enterprises and public-sector organisations.
What to look for
- Encrypted files commonly given a ".play" extension
- A ransom note typically named "ReadMe.txt", referencing the Play group and a contact email
- Initial access frequently traced to VPN or remote desktop systems
- Double extortion, with stolen data used as leverage
Recovery approach
Like Akira, Play often gets in through remote access left exposed to the internet — closing that gap is part of our post-incident hardening, not just the recovery.
OTHER FAMILIES WE SEE
Also covered
Medusa
A ransomware-as-a-service group operating a public leak site, frequently targeting healthcare and education.
What to look for →Ryuk
An older but historically significant family, often deployed as the final stage of a wider malware infection.
What to look for →LockBit
One of the most widespread ransomware-as-a-service operations, active against organisations worldwide.
What to look for →Akira
A newer group known for exploiting VPN and remote-access weaknesses to gain entry.
What to look for →