PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting Operations

Key facts for PLAY ransomware operation

Detection coverage for PLAY ransomware operation

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5283 across Splunk SPL, Microsoft KQL and Sigma, covering 24 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: PLAY Ransomware Exchange ProxyNotShell Shell Spawn (CVE-2022-41080 / CVE-2022-41082) — Exploitation

Detects an Exchange IIS worker process (w3wp.exe running an MSExchange app pool) spawning cmd, PowerShell, certutil, bitsadmin, mshta, rundll32 or wmic. Symantec reported Play operators gaining initial access through the Exchange ProxyNotShell chain CVE-2022-41080 and CVE-2022-41082 (T1190), followed by command execution (T1059.001). Exchange worker processes rarely spawn interpreters in normal operation.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1059.001
• Data sources: sysmon, windows_security
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\w3wp.exe" ParentCommandLine="*MSExchange*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\wmic.exe")
| fillnull value="unknown" User
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_processes values(CommandLine) as commands by host User ParentCommandLine
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5283 CVE-2022-41080 CVE-2022-41082 Exchange ProxyNotShell w3wp shell spawn"

Microsoft KQL

DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe" and InitiatingProcessCommandLine has "MSExchange"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "wmic.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256

Sigma

title: PLAY Ransomware Exchange ProxyNotShell Worker Process Spawning Shell (CVE-2022-41080, CVE-2022-41082)
id: 7d1f0a52-8301-4c6e-9b1a-52830a000001
status: experimental
description: Detects an Exchange IIS worker process (w3wp.exe hosting an MSExchange app pool) spawning a command interpreter or LOLBin, the post-exploitation signature of CVE-2022-41080/CVE-2022-41082 (ProxyNotShell) exploitation that Symantec linked to Play ransomware initial access.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
    - https://www.security.com/threat-intelligence/play-ransomware-volume-shadow-copy
    - https://www.trendmicro.com/en_us/research/24/h/pressing-pause-on-play-ransomware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
    - cve.2022-41080
    - cve.2022-41082
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: 'MSExchange'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\wmic.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Exchange diagnostic or third-party monitoring scripts launched from an app pool
    - Legitimate Exchange hybrid configuration tooling
level: high

Known false positives:

• Exchange diagnostic or third-party monitoring scripts launched from an app pool
• Legitimate Exchange hybrid configuration tooling spawning PowerShell

Tuning notes: Adjust index=sysmon to your Sysmon index. Allowlist known monitoring agent command lines by ParentCommandLine or CommandLine. Requires Sysmon EventCode 1 with ParentCommandLine (Sysmon 12+). Pair with IIS logs for autodiscover/powershell requests carrying an encoded @ SSRF pattern.

• 🔒 PLAY Ransomware [indicator] File Encryption and Drive-Root [indicator] Note — Impact · unlock with TL Creds
• 🔒 PLAY Ransomware Defender Tampering and Event Log Clearing — Defense Evasion · unlock with TL Creds
• 🔒 PLAY Ransomware WinRAR Staging and WinSCP SFTP Exfiltration — Exfiltration · unlock with TL Creds
• 🔒 PLAY Ransomware Recon Tooling and Known Toolset Hashes — AdFind, NetScan, WinPEAS, Grixba · unlock with TL Creds
• 🔒 PLAY Ransomware PsExec Service and Scheduled Task Deployment — Lateral Movement · unlock with TL Creds
• 🔒 PLAY Ransomware Cobalt Strike SMB Beacon Named Pipes — C2 and Lateral Movement · unlock with TL Creds
• 🔒 PLAY Ransomware Mimikatz LSASS Credential Dumping — Post-Exploitation · unlock with TL Creds
• 🔒 PLAY Ransomware C2 Infrastructure Contact (Symantec and Community IOCs) — C2 · unlock with TL Creds

Indicators of compromise for PLAY ransomware operation

As of 2026-11-05, Threadlinqs Intelligence tracks 24 indicators of compromise for TL-2026-5283.

Sample indicators (3 of 24)

• IP address: 137.220.49[.]66
• Domain: justiceukraine[.]com
• File hash: 223eff1610b432a1f1aa06c60bd7b9a6

Defanged, TLP:CLEAR. Full set of 24 indicators: unlock with TL Creds.

How PLAY ransomware operation works

PLAY ransomware emerged in June 2022 and was first deeply reverse engineered by Chuong Dong (published 2022-09-03). The sample is a 32-bit Windows executable that appends the .play extension, drops a single ReadMe.txt ransom note in the drive root (not per-folder) with a GMX contact email (teilightomemaucd@gmx.com), and spawns separate threads for depth-first drive traversal and file encryption. It skips .exe, .dll, .lnk, .sys, .msi, .PLAY, ReadMe.txt, bootmgr, files under 6 bytes and the Windows directory, and attempts to mount unmounted volumes with more than 0x40000000 bytes free. Supported arguments are -mc (standard run), -d <path> (specific drive/folder/file) and -ip <resource> <user> <pass> (network shares).

The cryptosystem is a generic RSA-AES hybrid. A random 0x20-byte key is generated with BCryptGenRandom, an AES key handle is created with BCryptGenerateSymmetricKey together with a random 0x10-byte IV, and the exported 0x230-byte key blob is encrypted with the embedded RSA public key. AES-GCM is the default chaining mode with AES-CBC as a faster fallback chosen from the file-to-chunk size ratio. Files under 0x100000 bytes are encrypted whole, files from 0x100000 to 0x500000 are encrypted in 0x100000-byte chunks, and larger files have only the first and last chunks encrypted. A 0x428-byte footer stores chunk metadata and the 1024-byte RSA-encrypted AES key blob. Database file types (mdf, ndf, ldf, frm) are treated as large files.

Anti-analysis includes ROP-style stack return address manipulation that breaks static disassembly in IDA, garbage code, API hashing (xxHash32, seed 1, plus constant 0x4E986790) resolved by walking DLL export tables, and in-memory string decryption.

Operationally, the Chuong Dong analysis ties PLAY to big game hunting campaigns active since mid-July 2022. These use SystemBC RAT for persistence, Cobalt Strike for post-compromise work, AdFind and custom PowerShell for enumeration, WinPEAS for privilege escalation, RDP/SMB for lateral movement and WinSCP for exfiltration. A documented victim is Argentina's Judiciary of Cordoba (mid-August 2022). Later reporting expands this picture. Symantec (2023-04-19) documented the custom .NET scanner/stealer Grixba and the AlphaVSS-based Volume Shadow Copy file-copy tool, Exchange exploitation (CVE-2022-41080, CVE-2022-41082), use of PsExec, WinRAR, WinSCP and NetScan, and intermittent encryption. Trend Micro documented Cobalt Strike beacons sharing watermark 206546002 with Emotet/SVCReady-delivered beacons used in Quantum ransomware activity, plus a 2024 MDR case featuring SystemBC, Grixba, PsExec and RDP. CISA advisory AA23-352A (2023-12-18, updated 2025-06-04) reports about 900 entities compromised by May 2025 and describes Mimikatz credential theft, Defender impairment, event log clearing, SFTP exfiltration, scheduled-task deployment and ransom notes directing victims to @gmx.de or @web.de addresses, with phone intimidation also used.

Attribution to a nation-state is not stated in any cited source; the operation is financially motivated.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.001 OS Credential Dumping: LSASS Memory

Discovery

T1018 Remote System Discovery; T1046 Network Service Discovery; T1087.002 Account Discovery: Domain Account

Lateral Movement

T1021.001 Remote Services: Remote Desktop Protocol; T1021.002 Remote Services: SMB/Windows Admin Shares

Defense Evasion

T1027 Obfuscated Files or Information; T1027.007 Obfuscated Files or Information: Dynamic API Resolution; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1048 Exfiltration Over Alternative Protocol

Execution

T1053.005 Scheduled Task/Job: Scheduled Task; T1059.001 Command and Scripting Interpreter: PowerShell

Command and Control

T1071.001 Application Layer Protocol: Web Protocols; T1090 Proxy

Initial Access

T1190 Exploit Public-Facing Application

Collection

T1560.001 Archive Collected Data: Archive via Utility

defense-impairment

T1685 Disable or Modify Tools; T1685.005 Clear Windows Event Logs

Remediation for PLAY ransomware operation

Patches

• Apply Microsoft Exchange updates addressing CVE-2022-41080 and CVE-2022-41082

Immediate actions

• Block and hunt for 137.220.49.66 and justiceukraine.com
• Hunt for .play extension files and ReadMe.txt ransom notes in drive roots
• Hunt for Grixba artifacts (export.zip with alive.csv, wm.csv, soft.csv, all_soft.csv, mount.csv, users.csv, remote_svc.csv, cached_RDP.csv)
• Isolate hosts showing Cobalt Strike beacons with watermark 206546002 or SystemBC proxy activity

Workarounds

• Limit outbound SFTP/SSH from servers to approved destinations
• Restrict scheduled task creation and remote service creation to administrative tooling

Longer-term hardening

• Restrict and monitor RDP and SMB lateral movement; enforce MFA on remote access
• Maintain offline, immutable, tested backups, including database servers
• Alert on WinSCP, AdFind, NetScan, PsExec and WinRAR use by non-admin accounts
• Alert on Defender tampering and Windows event log clearing

Affected and fixed versions

• Microsoft — Windows (32-bit PLAY encryptor executes on Windows; targets servers and workstations)
  Vulnerable versions: All unprotected Windows hosts reachable by the operators
• Microsoft — Exchange Server (initial access via CVE-2022-41080 and CVE-2022-41082 per Symantec)
  Vulnerable versions: Unpatched Exchange Server
  Fixed in: Builds with the November 2022 security updates or later

Timeline of PLAY ransomware operation

• 2022-06-01 locked-ioc-24/PlayCrypt ransomware operation launches (June 2022; month-level date per Symantec reporting).
• 2022-07-15 Big game hunting campaigns using locked-ioc-16 and locked-ioc-13 observed since mid-July 2022 (approximate date per Chuong Dong).
• 2022-08-15 Judiciary of Cordoba, Argentina is hit by locked-ioc-24 ransomware (mid-August 2022; announced publicly by a journalist; approximate date).
• 2022-09-03 Chuong Dong publishes the reverse engineering analysis of the locked-ioc-24 encryptor covering anti-analysis, RSA-AES cryptosystem, footer format and CLI arguments.
• 2023-04-19 Symantec publishes on Balloonfly/locked-ioc-24 custom tools locked-ioc-20 and locked-ioc-18, Exchange exploitation (CVE-2022-41080, CVE-2022-41082) and intermittent encryption.
• 2023-07-21 Trend Micro reports locked-ioc-24 locked-ioc-13 beacons share watermark 206546002 with beacons dropped by Emotet and SVCReady in Quantum ransomware activity.
• 2023-12-18 CISA, FBI and ACSC release #StopRansomware advisory AA23-352A on locked-ioc-24 ransomware.
• 2024-08-01 Trend Micro publishes an MDR case on a locked-ioc-24 intrusion attempt in early 2024 involving locked-ioc-16, locked-ioc-20, PsExec and RDP (publication date approximate).
• 2025-06-04 CISA updates AA23-352A; approximately 900 entities reported compromised by May 2025.

Sources cited for PLAY ransomware operation

• CISA Advisory AA23-352A: #StopRansomware: Play Ransomware CISA · Government advisory · 2023-12-18
• PLAY Ransomware - Chuong Dong chuongdong.com · Research · 2022-09-03
• Play Ransomware Group Using New Custom Data-Gathering Tools (Symantec) security.com · Vendor report · 2023-04-19
• Pressing Pause on Play Ransomware (Trend Micro) Trend Micro · Vendor report · 2024-08-01
• Play ransomware / PlayCrypt overview (Vectra AI) vectra.ai · Research
• Updated Response to CISA Advisory (AA23-352A): #StopRansomware: Play Ransomware (AttackIQ) attackiq.com · Blog · 2025-06-12
• Play Ransomware Gang Uses Custom Shadow Volume Copy Data-Theft Tool (BleepingComputer) BleepingComputer · News · 2023-04-19

More in ransomware

• Halcyon August 2026 Ransomware Report: 10 of Top 15 Families New vs. July; Manufacturing Top Target
• Dark Project Ransomware Gang Claims 38 Victims Across 8 Countries, Targeting Healthcare and Manufacturing
• BlackNevas and The Gentlemen Ransomware Cases Against ESXi and Proxmox Virtualization Environments
• HYFLOCK Ransomware-as-a-Service: Partial (First 4KB) Encryption of Larger Files
• Vexy Ransomware claims ZipAI (Vietnam, Technology) - 15.73 GB exfiltrated

More from Play - G1040

• 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
• SystemBC (Coroxy) Malware: Tor-Based SOCKS5 Proxy Backdoor Enabling Ransomware Persistence and C2 Obfuscation

Other reports on CVE-2022-41082

• FamousSparrow APT Targets Azerbaijani Oil & Gas Sector via ProxyShell/ProxyNotShell Exchange Exploitation
• US Indicts Alleged Operators of Media Land Bulletproof Hosting Service Used by LockBit, BlackSuit, and Play Ransomware
• StrikeShark Campaign: SharkLoader Dropper Targets Governments and Software Developers via N-Day Exploits and Trojanized Installers to Deploy Cobalt Strike
• SharkLoader Malware Campaign Uses Fake Cisco AnyConnect and Google Update Installers to Deploy Cobalt Strike
• SharkLoader Malware Deploys Cobalt Strike Beacon via DLL Side-Loading in StrikeShark Campaign
• FamousSparrow APT Multi-Wave Intrusion at Azerbaijani Oil & Gas Company — Evolved Two-Stage DLL Sideloading Delivers Deed RAT (0xFF66ABCD) and Terndoor via Mofu Loader

Previous and next in ransomware

• Darkside Ransomware v1.8.6.2 - Reverse Engineering Analysis Previous report
• LockBit 2.0 Ransomware (Bitwise Spider) - Technical Reverse Engineering Analysis Next report