PLAYMalware
- PlayCrypt
According to PCrisk, PLAY is the name of a ransomware-type program. Malware categorized as such operates by encrypting data and demanding ransoms for the decryption. After we executed a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ". PLAY" extension. For example, a file titled "1.jpg" appeared as "1.jpg. PLAY", "2.png" as "2.png.From MISP Galaxy
Last reported 1 month ago, by Risky Business News1 report
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Risky Bulletin: Russia starts blocking DoH and DoT“Play (aka PlayCrypt) ransomware: Researchers look over the tactics of the Play/PlayCrypt group, a double-extortion ransomware operation that's been around since 2022.”
Indicators in its reports
named in the reports above- xn--eck9c3e[.]zonein 1 report
Copy this indicator · defanged
Thanks — we review every report.