Play (Ransomware) – Malware

Overview

In the ever-evolving landscape of cybersecurity threats, ransomware remains one of the most insidious forms of attack. Among the growing number of ransomware families, Play ransomware has emerged as a particularly dangerous variant since its first observed activity in June 2022. Notably named after the .play file extension it appends to encrypted files, Play ransomware distinguishes itself through its dual-pronged approach to extortion. Victims not only face the immediate threat of data encryption but also the risk of sensitive information being publicly disclosed on the attackers’ Tor-based sites. This multi-extortion strategy significantly heightens the stakes for targeted organizations, compelling them to navigate the difficult decision of whether to pay the ransom. The Play ransomware group exhibits a broad and indiscriminate targeting pattern, often focusing on large enterprises across critical sectors such as healthcare, finance, manufacturing, real estate, and education. Their operational tactics highlight a sophisticated understanding of organizational vulnerabilities, making them a formidable adversary in the realm of cyber threats. By leveraging vulnerabilities in Remote Desktop Protocol (RDP) servers and exploiting specific flaws in systems like Fortinet FortiOS, Play ransomware operators gain initial access to their targets. This ability to penetrate defenses underscores the urgent need for organizations to enhance their cybersecurity postures. Once they infiltrate a network, Play ransomware actors prioritize stealth and operational security. They employ various tactics, including the use of Living off the Land Binaries (LOLBins) and commodity tools like AnyDesk and NetScan, to mask their activities and evade detection. The deployment of intermittent encryption techniques further complicates detection efforts, as it allows attackers to partially encrypt files in a manner that can elude traditional security measures. As Play ransomware continues to evolve, organizations must remain vigilant in their defense strategies. A robust approach that includes employee education, threat detection technologies, and effective incident response plans is critical in mitigating the risks associated with this and other ransomware families. Understanding the operational mechanics of Play ransomware is key to developing a proactive and informed defense strategy that can protect valuable data from falling into the hands of cybercriminals.

Targets

Information Public Administration

How they operate

The initial access point for Play ransomware is typically gained through the exploitation of vulnerabilities in public-facing applications. Threat actors often target misconfigured or poorly secured Remote Desktop Protocol (RDP) servers, which can be easily compromised. Additionally, the group has been observed leveraging specific vulnerabilities in Fortinet’s FortiOS and utilizing the ProxyNotShell exploits to establish a foothold within target environments. Once inside, the attackers execute a series of operations designed to mask their activities, employing living-off-the-land binaries (LOLBins) and common tools such as AnyDesk and NetScan for lateral movement and discovery. A hallmark of Play ransomware’s operational methodology is its use of command-line interfaces and scripts to execute payloads. Attackers rely heavily on commodity tools like Cobalt Strike and Empire for lateral movement, enabling them to explore the network and identify critical data. They employ techniques like intermittent encryption, where only chunks of data are encrypted at a time, making detection more challenging for traditional security measures. This unique approach allows Play ransomware to maintain a lower profile while encrypting valuable data, effectively evading detection by legacy malware systems. Once the attackers have secured their foothold and gathered sufficient information, they initiate the encryption process. By leveraging the Active Directory (AD) environment, Play ransomware spreads its payloads efficiently throughout the network. The encryption process targets specific file types and directories, rendering critical data inaccessible to the victim organization. In addition to encryption, Play ransomware often exfiltrates sensitive information, adding another layer to its multi-extortion strategy. The threat actors then demand a ransom in exchange for decryption keys and assurance that the stolen data will not be released publicly. Detection of Play ransomware presents a unique challenge. Organizations are encouraged to implement a multi-layered security approach that includes robust anti-malware solutions capable of identifying known ransomware variants, continuous monitoring of network traffic for anomalies, and regular security audits to uncover vulnerabilities. Employee training is also crucial, as human error often serves as the entry point for ransomware attacks. Organizations that prioritize education on cybersecurity best practices and recognize the signs of phishing and malicious activities can significantly reduce their risk of falling victim to Play ransomware. In conclusion, Play ransomware operates through a combination of sophisticated techniques, exploiting vulnerabilities, and employing stealthy tactics to achieve its malicious objectives. By understanding the technical intricacies of how this ransomware operates, organizations can better prepare themselves against potential attacks and implement effective detection and mitigation strategies. As the cyber threat landscape continues to evolve, staying informed and vigilant is paramount to protecting sensitive data and maintaining operational integrity.

MITRE Tactics and Techniques

Initial Access (TA0001)

Exploitation of Public-Facing Application (T1190): Play ransomware targets vulnerabilities in publicly accessible applications, such as Fortinet FortiOS and other web services. Valid Accounts (T1078): The use of stolen credentials to gain access to systems, particularly through compromised Remote Desktop Protocol (RDP) sessions.

Execution (TA0002)

Command and Scripting Interpreter (T1059): Play ransomware utilizes command-line tools and scripts to execute malicious payloads and commands on the infected systems. Scheduled Task/Job (T1053): Attackers may create scheduled tasks to execute ransomware payloads at specific times.

Persistence (TA0003)

Boot or Logon Autostart Execution (T1547): The ransomware may establish persistence by modifying registry keys or using other autostart methods to ensure it runs at system startup. Scheduled Task/Job (T1053): This technique can also be used for persistence by scheduling tasks that execute ransomware components regularly.

Privilege Escalation (TA0004)

Exploitation of Vulnerability (T1203): Attackers may exploit known vulnerabilities in applications or services to gain elevated privileges within the network.

Defense Evasion (TA0005)

Obfuscated Files or Information (T1027): The ransomware may use obfuscation techniques to hide its presence and evade detection by security software. Living off the Land Binaries (LOLBins) (T1218): Play ransomware often uses legitimate system binaries for malicious purposes, which can help bypass security measures.

Credential Access (TA0006)

Credential Dumping (T1003): Play ransomware actors may attempt to extract user credentials from the compromised systems to facilitate lateral movement within the network.

Discovery (TA0007)

Network Share Discovery (T1135): The ransomware scans for accessible network shares and critical data to target during the attack. System Information Discovery (T1082): Gathering information about the system and network to identify valuable targets.

Lateral Movement (TA0008)

Remote Services (T1021): Using protocols like RDP and SMB to move laterally across the network to infect additional systems.

Impact (TA0009)

Data Encrypted for Impact (T1486): The primary objective of Play ransomware is to encrypt files and data, rendering them inaccessible to the victim and demanding a ransom for recovery. Data Exfiltration (T1041): Play ransomware may also threaten to leak sensitive data as part of their extortion strategy.  

References:

• Play