Ransomware Group
Play
Also known as: PlayCrypt
Status: active • First seen 2022-06 • 300+ known victims
Play attacks city governments and companies by exploiting email servers and firewalls. They caused major disruption to Oakland city services.
Overview
Play ransomware has targeted government organizations including the City of Oakland. The group exploits Microsoft Exchange and Fortinet vulnerabilities.
Target Industries
Government, Technology, Transportation, Manufacturing
How They Attack
- • ProxyNotShell exploitation
- • FortiOS exploitation
- • Double extortion
- • Government targeting
Notable Victims
City of Oakland (2023), Arnold Clark (2022)
Is your business exposed?
How to Protect Against Play
- 1.
Patch Exchange servers
- 2.
Update FortiOS immediately
- 3.
Implement government security protocols
MITRE ATT&CK Techniques
Is your business exposed?
Check if your company data is circulating on the dark web
Free scan • No credit card required