Play

☆ pin

Also known as PlayCrypt

Reports

First seen

May 13, 2025

Last seen

Oct 16, 2026

Motivation

Financial

Relationships

Filled ◆ = CVE exploited in the wild. Entities that appear together in Signalis reporting — co-mention, not confirmed collaboration. Reports naming many actors at once (weekly roundups) are excluded from relationship edges.

Targeting

Sectors

Manufacturing ×14 Other ×9 Retail & E-commerce ×7 Professional Services ×6 Financial Services ×5 Hospitality ×4 Transport & Logistics ×3 Telecommunications ×2

Victim regions

×1

×24

United States×24

Netherlands×2

Belgium×2

Sweden×1

Andorra×1

Canada×1

Germany×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1486 Data Encrypted for Impact ×2T1003 OS Credential Dumping ×2T1562.001 Impair Defenses: Disable or Modify Tools ×2T1021.001 Remote Services: Remote Desktop Protocol ×2T1218 System Binary Proxy Execution ×1T1566.002 Phishing: Spearphishing Link ×1T1192 Spearphishing Link ×1T1003.006 OS Credential Dumping: DCSync ×1T1068 Exploitation for Privilege Escalation ×1T1047 Windows Management Instrumentation ×1T1547 Boot or Logon Autostart Execution ×1T1204.002 User Execution: Malicious File ×1

Indicators

domain ×99cve ×68filename ×41hash_sha1 ×10hash_md5 ×10hash_sha256 ×10ip_v4 ×4url ×2registry_key ×1

Indicator values are available on Pro and via the API.

Associated CVEs

CVE-2026-66747 (exploited)CVE-2026-74232 (exploited)CVE-2026-74233 (exploited)CVE-2026-81578 (exploited)CVE-2026-82078 (exploited)

Recent reports

High

Play

Relationships

Targeting

Top ATT&CK techniques

Indicators

Associated CVEs

Recent reports

Play ransomware claims WSBI-ESBG victim

Play ransomware publishes WSBI-ESBG as victim

Play ransomware publishes New Tec Tool Limited as victim

Play ransomware group claims New Tec Tool Limited as victim

Play ransomware gang publishes MicroSearch Corporation as victim

Play ransomware gang claims MicroSearch Corporation victim

Play ransomware gang publishes Pure Options as victim

Play ransomware group publishes Pure Options as victim

Play ransomware claims victim: The Innovation Group

Play ransomware gang publishes DFK Group as victim

Play ransomware publishes Saddlers Court MFG as victim

Play ransomware gang publishes Culinary Specialties as victim

Play ransomware gang publishes Advanced Imaging Solutions as victim

Play ransomware gang publishes Bold Spring Nursery as victim

Play ransomware gang publishes Silicon Valley Glass as victim

Play ransomware gang publishes new victim: Titus

Play ransomware gang publishes Airtech Mechanical Services as victim

Play ransomware claims Orth Automobile as victim

Play ransomware publishes Starr Whitehouse Landscape Architects as victim

Play ransomware gang publishes Ever Ready First Aid as victim

Play ransomware gang publishes Metallco as victim

Play ransomware gang publishes Hurley as new victim

Play ransomware gang publishes Vista Plastic Solutions as victim

Play ransomware gang publishes Inglewood Golf as victim

Play ransomware gang publishes Barrett Mahony Consulting Engineers as victim

Play ransomware gang publishes Sys-kool as victim

Play ransomware gang publishes Grunthal Welding & Supplies as victim

Play ransomware gang publishes Red Star Oil as victim

Play ransomware gang publishes GT Distributors as victim

Play ransomware operators claim new victim: MEQ