Malware

PLAY

Also known as: PlayCrypt

According to PCrisk, PLAY is the name of a ransomware-type program. Malware categorized as such operates by encrypting data and demanding ransoms for the decryption. After we executed a sample of this ransomware on our test machine, it encrypted files and appended their filenames with a ".PLAY" extension. For example, a file titled "1.jpg" appeared as "1.jpg.PLAY", "2.png" as "2.png.PLAY", etc. Once the encryption process was completed, PLAY created a text file named "ReadMe.txt" on the desktop.

Source Articles

US charges alleged operators of Russian bulletproof hosting service

U.S. authorities have charged three Russian nationals for operating bulletproof hosting services, Media Land and ML.Cloud, which provided infrastructure to ransomware groups such as Lockbit, Blacksuit, and Play. These services enabled cybercriminals to conduct malware delivery, command-and-control operations, DDoS attacks, and phishing campaigns while evading takedowns. The services caused over $62 million in damages globally and targeted critical infrastructure, including banks, schools, hospitals, and government entities across 21 U.S. states.

bleeping-computer ·1w ago