Play

☆ pin

Reports

First seen

May 13, 2025

Last seen

Aug 9, 2026

Motivation

Financial

Targeting

Sectors

Manufacturing ×7 Other ×6 Retail & E-commerce ×4 Professional Services ×4 Transport & Logistics ×3 Hospitality ×3 Telecommunications ×2 Financial Services ×2

Victim regions

×1

×14

United States×14

Netherlands×2

Sweden×1

Andorra×1

Victim country, only when stated. Corpus is predominantly English-language reporting, so US/EU coverage is overweighted relative to true victim distribution.

Top ATT&CK techniques

T1021.001 Remote Services: Remote Desktop Protocol ×2T1562.001 Impair Defenses: Disable or Modify Tools ×2T1204.002 User Execution: Malicious File ×1T1560.001 Archive Collected Data: Archive via Utility ×1T1003 OS Credential Dumping ×1T1036 Masquerading ×1T1566.002 Phishing: Spearphishing Link ×1T1070.001 Indicator Removal: Clear Windows Event Logs ×1T1021.002 Remote Services: SMB/Windows Admin Shares ×1T1110 Brute Force ×1T1486 Data Encrypted for Impact ×1T1003.006 OS Credential Dumping: DCSync ×1

Indicators

domain ×60filename ×40hash_sha256 ×10hash_sha1 ×10hash_md5 ×10ip_v4 ×4url ×2registry_key ×1

Indicator values are available on Pro and via the API.

Recent reports

High

Play

Targeting

Top ATT&CK techniques

Indicators

Recent reports

Play ransomware gang publishes MIE Solutions as victim

Play ransomware gang publishes Rilpa Enterprises as victim

Play ransomware gang publishes Marconi Industrial Services as victim

Play ransomware gang publishes Signature Services as victim

Play ransomware gang publishes GCATS Investments as victim

Play ransomware gang publishes Platinum Group as victim

Play ransomware gang publishes First Tek as victim

Play ransomware claims Preferred Financial Group as victim

Play ransomware gang publishes The Butcher Brothers as victim

Play ransomware claims Sigma Plastics Group as victim

Play ransomware publishes Cambridge Management as victim

Play ransomware publishes Record Go Alquiler as victim

Play ransomware gang publishes Restaurant Depot as victim

Play ransomware publishes DeBruler as victim

Play ransomware gang claims new victim: Tax MT

Play ransomware group publishes Kreysler & Associates as victim

Play ransomware gang publishes Boston Electric and Telephone as victim

Play ransomware gang publishes Wring Group as new victim

Play ransomware gang publishes AG Scholtes as victim

Play ransomware gang publishes Andorra Life as victim

Play ransomware publishes Svensk Direktreklam as victim

US unseals indictment against alleged operators of Russian bulletproof hosting service

Play ransomware gang publishes Preneed Funeral Programs as victim

Play ransomware gang publishes Kevin Bao Lenguyen as victim

Play ransomware claims United Infrastructure as victim

Play ransomware gang publishes Locati Architects as victim

Play ransomware gang publishes Silvestri & Associates Insurance as victim

Play ransomware publishes Western Construction as victim

Play ransomware gang publishes J&J Gaming as victim

Play ransomware gang publishes Kuhnline as victim