iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Play ransomware attacks combine data theft with file encryption, so victims may face both disrupted systems and threats to publish stolen information. In a joint warning first issued by CISA, the FBI, and Australia’s cyber authority on December 18, 2023, the agencies described attacks affecting organizations across multiple regions. Their technical guidance was revised on June 4, 2025, and is the better reference for current defensive priorities.
What the warning says—and how to read the numbers
Play, also known as Playcrypt, has been active since June 2022 and has affected organizations in North and South America and Europe, according to the joint CISA, FBI, and ASD’s ACSC advisory. The FBI was aware of approximately 900 affected entities allegedly exploited as of May 2025. That is an agency estimate, not a count of individually confirmed victims or a live total.
The December 19, 2023 SecurityWeek report said the FBI knew of approximately 300 victims as of October 2023. It also described roughly 100 additional alleged victims identified through a review of Play’s leak site over the preceding two months. Those leak-site allegations are distinct from the FBI figure.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The older and newer FBI figures use different dates and wording—“victims” in the 2023 report and “affected entities allegedly exploited” in the 2025 advisory—so they should not be treated as directly comparable confirmed totals.
#1 Best Overall
- World’s First 6TB 2.5” Portable Hard Drive
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
How Play ransomware attacks work
Access to the network
The advisory describes several observed entry paths: abuse of valid accounts, exploitation of public-facing applications, and access through external-facing remote services such as Remote Desktop Protocol (RDP) and virtual private networks (VPNs). Historical vulnerabilities named include FortiOS CVE-2018-13379 and CVE-2020-12812, and Microsoft Exchange ProxyNotShell vulnerabilities CVE-2022-41040 and CVE-2022-41082. These examples are not a complete list of Play access methods, and the advisory does not imply that every vulnerable system was exploited.
Discovery, theft, and encryption
Once inside, attackers have used tools for network discovery, credential theft, lateral movement, and evading defenses. The agencies describe a double-extortion model: “Play ransomware actors employ a double extortion model, encrypting systems after exfiltrating data.” Data has been split into segments, compressed in RAR format, and transferred using WinSCP before systems are encrypted with AES-RSA hybrid encryption. Encrypted files receive the .PLAY extension.
Rank #2
- Slim durable design to help take your important files with you
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
The June 2025 advisory says the ransomware binary is recompiled for each attack, which makes relying on file hashes alone a weak detection strategy. Monitoring for suspicious account use, unusual data transfers, and movement between systems can provide signals beyond a known-malware signature.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesContact and ransom demands
The advisory characterizes Play as a presumed closed group. Victims may receive a unique email address, commonly using @gmx.de or @web.de, and some have also been contacted by telephone. Ransom notes do not include an initial payment demand or payment instructions; they direct victims to contact the attackers.
Rank #3
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Defenses agencies recommend
Reduce the chances of initial access
- Prioritize patching known exploited vulnerabilities, and keep operating systems, applications, and firmware updated.
- Require multifactor authentication wherever possible, especially for webmail, VPNs, and accounts that can reach critical systems.
- Assess vulnerabilities regularly and filter or restrict untrusted access to remote services.
- Use least privilege and audit privileged accounts so a compromised account has less reach.
Limit movement and improve detection
- Segment networks so access to one system does not automatically provide access to critical servers or backups.
- Monitor for abnormal account activity, suspicious data movement, and lateral movement across systems.
- Use endpoint detection capabilities and validate that security tools can identify the techniques described in the advisory; tune them based on the results.
Build recovery around separate, tested copies
The advisory recommends multiple copies of sensitive or proprietary data and servers in physically separate, segmented, secure locations. It also calls for offline backups and encrypted, immutable backup data. An external hard drive can be one offline copy, but a single drive is not a complete recovery design. Organizations should test restores and exercise their recovery plan so they know whether data can be recovered within operational needs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Reporting an incident and considering payment
Ransom payment does not guarantee that files will be recovered, and the advisory warns that payment may encourage further criminal activity. For incidents in the United States, the agencies urge reporting to a local FBI field office, the FBI’s Internet Crime Complaint Center (IC3), or CISA. Australian organizations can report through ASD’s Australian Cyber Security Centre (ACSC).
Rank #4
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
The agencies’ joint technical guidance is available in CISA advisory AA23-352A. The original December 2023 warning is also available as a December 2023 advisory PDF.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Best Value
- Slim durable design to help take your important files with you
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- Back up smarter with included device management software[2] with defense against ransomware
- Help secure your important files with password protection and hardware encryption
- 3-year limited warranty
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
