Threat video1:00
PLAY Ransomware Reverse Engineering: Detection & IOCs
PLAY encrypts files as .play after stealing data, with SystemBC and Cobalt Strike in its toolkit. 9 detection rules, 24 IOCs and a free Splunk SPL rule.
Read the full threat intel for PLAY Ransomware Reverse Engineering: Detection & IOCs →
Chapters
- 0:00The hookAbout ~900 organizations compromised by PLAY.
- 0:04The storyPLAY emerged in twenty-twenty-two.
- 0:10Attack pathAttackers exploit Exchange, SystemBC handles communications.
- 0:26AttributionAttributed to Play - G1040.
- 0:31Indicators of compromise13 indicators to hunt: 1 IP, 1 domain and 5 SHA-256 hashes, and more.
- 0:39MITRE ATT&CK techniques18 ATT&CK techniques, from initial access to exfiltration.
- 0:44Remediation4 steps now: Block and hunt.
- 0:51Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00About ~900 organizations compromised by PLAY.
0:05PLAY emerged in twenty-twenty-two.
0:07By now, ~900 organizations hit.
0:10Attackers exploit Exchange, SystemBC handles communications.
0:15Credentials stolen from networks, systems compromised.
0:18Data extracted, files encrypted, demands posted.
0:22Victims face demands or public exposure.
0:27Attributed to Play - G1040. Confidence: low.
0:3213 indicators to hunt: 1 IP, 1 domain and 5 SHA-256 hashes, and more.
0:4018 ATT&CK techniques, from initial access to exfiltration.
0:444 steps now: Block and hunt.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.