# PLAY Ransomware (PlayCrypt) - Reverse Engineering Analysis and Big Game Hunting Operations

> PLAY (aka PlayCrypt, tracked by Symantec as Balloonfly) is a double-extortion ransomware operation active since mid-2022 that appends .play to encrypted files and uses an RSA-AES hybrid scheme. Operators use SystemBC, Cobalt Strike, AdFind, Grixba, WinPEAS and WinSCP, and CISA reported about 900 affected entities by May 2025.

- **Published:** 2026-11-05T00:38:12Z
- **Last reviewed:** 2026-11-05T00:38:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5283
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5283.png
- **ID:** TL-2026-5283
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Play - G1040
- **Detections:** 9 (1 shown free below) · **IOCs:** 24 (3 shown free below)
- **CVEs:** CVE-2022-41080, CVE-2022-41082

## Description

PLAY ransomware emerged in June 2022 and was first deeply reverse engineered by Chuong Dong (published 2022-09-03). The sample is a 32-bit Windows executable that appends the .play extension, drops a single ReadMe.txt ransom note in the drive root (not per-folder) with a GMX contact email (teilightomemaucd@gmx.com), and spawns separate threads for depth-first drive traversal and file encryption. It skips .exe, .dll, .lnk, .sys, .msi, .PLAY, ReadMe.txt, bootmgr, files under 6 bytes and the Windows directory, and attempts to mount unmounted volumes with more than 0x40000000 bytes free. Supported arguments are -mc (standard run), -d <path> (specific drive/folder/file) and -ip <resource> <user> <pass> (network shares).

The cryptosystem is a generic RSA-AES hybrid. A random 0x20-byte key is generated with BCryptGenRandom, an AES key handle is created with BCryptGenerateSymmetricKey together with a random 0x10-byte IV, and the exported 0x230-byte key blob is encrypted with the embedded RSA public key. AES-GCM is the default chaining mode with AES-CBC as a faster fallback chosen from the file-to-chunk size ratio. Files under 0x100000 bytes are encrypted whole, files from 0x100000 to 0x500000 are encrypted in 0x100000-byte chunks, and larger files have only the first and last chunks encrypted. A 0x428-byte footer stores chunk metadata and the 1024-byte RSA-encrypted AES key blob. Database file types (mdf, ndf, ldf, frm) are treated as large files.

Anti-analysis includes ROP-style stack return address manipulation that breaks static disassembly in IDA, garbage code, API hashing (xxHash32, seed 1, plus constant 0x4E986790) resolved by walking DLL export tables, and in-memory string decryption.

Operationally, the Chuong Dong analysis ties PLAY to big game hunting campaigns active since mid-July 2022. These use SystemBC RAT for persistence, Cobalt Strike for post-compromise work, AdFind and custom PowerShell for enumeration, WinPEAS for privilege escalation, RDP/SMB for lateral movement and WinSCP for exfiltration. A documented victim is Argentina's Judiciary of Cordoba (mid-August 2022). Later reporting expands this picture. Symantec (2023-04-19) documented the custom .NET scanner/stealer Grixba and the AlphaVSS-based Volume Shadow Copy file-copy tool, Exchange exploitation (CVE-2022-41080, CVE-2022-41082), use of PsExec, WinRAR, WinSCP and NetScan, and intermittent encryption. Trend Micro documented Cobalt Strike beacons sharing watermark 206546002 with Emotet/SVCReady-delivered beacons used in Quantum ransomware activity, plus a 2024 MDR case featuring SystemBC, Grixba, PsExec and RDP. CISA advisory AA23-352A (2023-12-18, updated 2025-06-04) reports about 900 entities compromised by May 2025 and describes Mimikatz credential theft, Defender impairment, event log clearing, SFTP exfiltration, scheduled-task deployment and ransom notes directing victims to @gmx.de or @web.de addresses, with phone intimidation also used.

Attribution to a nation-state is not stated in any cited source; the operation is financially motivated.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1053.005 Scheduled Task/Job: Scheduled Task
- T1027 Obfuscated Files or Information
- T1027.007 Obfuscated Files or Information: Dynamic API Resolution
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1685.005 Clear Windows Event Logs
- T1003.001 OS Credential Dumping: LSASS Memory
- T1087.002 Account Discovery: Domain Account
- T1018 Remote System Discovery
- T1046 Network Service Discovery
- T1021.001 Remote Services: Remote Desktop Protocol
- T1021.002 Remote Services: SMB/Windows Admin Shares
- T1560.001 Archive Collected Data: Archive via Utility
- T1090 Proxy
- T1071.001 Application Layer Protocol: Web Protocols
- T1048 Exfiltration Over Alternative Protocol

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**PLAY Ransomware Exchange ProxyNotShell Shell Spawn (CVE-2022-41080 / CVE-2022-41082) — Exploitation** (`TL-2026-5283-SPL-001`)

Detects an Exchange IIS worker process (w3wp.exe running an MSExchange app pool) spawning cmd, PowerShell, certutil, bitsadmin, mshta, rundll32 or wmic. Symantec reported Play operators gaining initial access through the Exchange ProxyNotShell chain CVE-2022-41080 and CVE-2022-41082 (T1190), followed by command execution (T1059.001). Exchange worker processes rarely spawn interpreters in normal operation.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1059.001
- **Data sources:** sysmon, windows_security
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h ParentImage="*\\w3wp.exe" ParentCommandLine="*MSExchange*" (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\certutil.exe" OR Image="*\\bitsadmin.exe" OR Image="*\\mshta.exe" OR Image="*\\rundll32.exe" OR Image="*\\wmic.exe")
| fillnull value="unknown" User
| stats count min(_time) as first_seen max(_time) as last_seen values(Image) as child_processes values(CommandLine) as commands by host User ParentCommandLine
| convert ctime(first_seen) ctime(last_seen)
| eval detection="TL-2026-5283 CVE-2022-41080 CVE-2022-41082 Exchange ProxyNotShell w3wp shell spawn"
```

### Microsoft KQL

```kql
DeviceProcessEvents
| where Timestamp > ago(24h)
| where InitiatingProcessFileName =~ "w3wp.exe" and InitiatingProcessCommandLine has "MSExchange"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "certutil.exe", "bitsadmin.exe", "mshta.exe", "rundll32.exe", "wmic.exe")
| project Timestamp, DeviceName, AccountName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, SHA256
```

### Sigma

```yaml
title: PLAY Ransomware Exchange ProxyNotShell Worker Process Spawning Shell (CVE-2022-41080, CVE-2022-41082)
id: 7d1f0a52-8301-4c6e-9b1a-52830a000001
status: experimental
description: Detects an Exchange IIS worker process (w3wp.exe hosting an MSExchange app pool) spawning a command interpreter or LOLBin, the post-exploitation signature of CVE-2022-41080/CVE-2022-41082 (ProxyNotShell) exploitation that Symantec linked to Play ransomware initial access.
references:
    - https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
    - https://www.security.com/threat-intelligence/play-ransomware-volume-shadow-copy
    - https://www.trendmicro.com/en_us/research/24/h/pressing-pause-on-play-ransomware.html
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1190
    - attack.execution
    - attack.t1059.001
    - cve.2022-41080
    - cve.2022-41082
logsource:
    category: process_creation
    product: windows
detection:
    selection_parent:
        ParentImage|endswith: '\w3wp.exe'
        ParentCommandLine|contains: 'MSExchange'
    selection_child:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\pwsh.exe'
            - '\certutil.exe'
            - '\bitsadmin.exe'
            - '\mshta.exe'
            - '\rundll32.exe'
            - '\wmic.exe'
    condition: selection_parent and selection_child
falsepositives:
    - Exchange diagnostic or third-party monitoring scripts launched from an app pool
    - Legitimate Exchange hybrid configuration tooling
level: high

```

**Known false positives:**

- Exchange diagnostic or third-party monitoring scripts launched from an app pool
- Legitimate Exchange hybrid configuration tooling spawning PowerShell

**Tuning notes:** Adjust index=sysmon to your Sysmon index. Allowlist known monitoring agent command lines by ParentCommandLine or CommandLine. Requires Sysmon EventCode 1 with ParentCommandLine (Sysmon 12+). Pair with IIS logs for autodiscover/powershell requests carrying an encoded @ SSRF pattern.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- PLAY Ransomware [indicator] File Encryption and Drive-Root [indicator] Note — Impact (locked: unlock with TL Creds)
- PLAY Ransomware Defender Tampering and Event Log Clearing — Defense Evasion (locked: unlock with TL Creds)
- PLAY Ransomware WinRAR Staging and WinSCP SFTP Exfiltration — Exfiltration (locked: unlock with TL Creds)
- PLAY Ransomware Recon Tooling and Known Toolset Hashes — AdFind, NetScan, WinPEAS, Grixba (locked: unlock with TL Creds)
- PLAY Ransomware PsExec Service and Scheduled Task Deployment — Lateral Movement (locked: unlock with TL Creds)
- PLAY Ransomware Cobalt Strike SMB Beacon Named Pipes — C2 and Lateral Movement (locked: unlock with TL Creds)
- PLAY Ransomware Mimikatz LSASS Credential Dumping — Post-Exploitation (locked: unlock with TL Creds)
- PLAY Ransomware C2 Infrastructure Contact (Symantec and Community IOCs) — C2 (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (3 of 24)

Defanged, TLP:CLEAR.

- IP address: `137.220.49[.]66`
- Domain: `justiceukraine[.]com`
- File hash: `223eff1610b432a1f1aa06c60bd7b9a6`

Full set of 24 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [PLAY Ransomware - Chuong Dong](https://www.chuongdong.com/reverse%20engineering/2022/09/03/PLAYRansomware/)
- [Play Ransomware Group Using New Custom Data-Gathering Tools (Symantec)](https://www.security.com/threat-intelligence/play-ransomware-volume-shadow-copy)
- [Pressing Pause on Play Ransomware (Trend Micro)](https://www.trendmicro.com/en_us/research/24/h/pressing-pause-on-play-ransomware.html)
- [CISA Advisory AA23-352A: #StopRansomware: Play Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a)
- [Updated Response to CISA Advisory (AA23-352A): #StopRansomware: Play Ransomware (AttackIQ)](https://www.attackiq.com/2025/06/12/updated-response-to-cisa-advisory-aa23-352a/)
- [Play Ransomware Gang Uses Custom Shadow Volume Copy Data-Theft Tool (BleepingComputer)](https://www.bleepingcomputer.com/news/security/play-ransomware-gang-uses-custom-shadow-volume-copy-data-theft-tool/)
- [Play ransomware / PlayCrypt overview (Vectra AI)](https://www.vectra.ai/threat-actors/play)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5283