Play

THREAT ACTOR PROFILE

Play

Play, also known as PlayCrypt, is a prolific double-extortion ransomware operation active since 2022. It has hit hundreds of organizations across critical infrastructure, running hands-on intrusions that pair a custom scanner, SystemBC and living-off-the-land tooling with a Windows privilege-escalation zero-day.

Country:

Not attributed

Category:

Ransomware (critical infrastructure)

First seen

2022

Latest IOC

IP indicators

Hosts

SHA256 hashes

Posts

IP indicators

Hosts

SHA256 hashes

Posts

TABLE OF CONTENTS

Names and aliases

Group profile

Attack lifecycle

Malware and tooling

IOCs

Notable campaigns

NAMES AND ALIASES

Play, PlayCrypt and the Balloonfly crew

Play is tracked under the brand name and the name of the crew that operates it. The names below map to one entry among the ransomware actors we document, so a PlayCrypt report and a Balloonfly advisory read as one operation.

GROUP PROFILE

Double extortion across critical infrastructure

Play runs a closed operation rather than a broad affiliate program, hitting organizations in the US, Europe and Latin America and posting victims to a Tor leak site. It has claimed more than 300 victims since mid-2022 and keeps a steady operational tempo.

Our record ties it to ransomware across critical infrastructure and many other sectors. Its tooling overlaps with the broader eCrime ecosystem, including SystemBC and a Betruger backdoor also seen with RansomHub affiliates.

The group's edge is disciplined, hands-on tradecraft: a custom reconnaissance scanner called Grixba, careful defense evasion, and a willingness to burn zero-days, including a 2025 Windows CLFS privilege-escalation flaw.

Facts:

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Initial Access

Russian Federation · GRU

Victims reported in our records and posts:

ATTACK LIFECYCLE

VPN and edge access into hands-on encryption

The stages below come from Play activity in posts we track on our IOC Hunter feed.

Initial Access

Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.

Initial Access

MALWARE AND TOOLING

Grixba, SystemBC and a living-off-the-land kit

Initial Access

CVES EXPLOITED

A Windows zero-day and edge flaws

CVE-2026-21509

A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.

CVE-2026-21509

RECENT {{name}} IOCS

Latest IOCs

We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

Showing a sample of recent indicators

Get the complete 8Base IOC set, full IP, host and hash history.

Unlock all the IOCs for Free

NOTABLE CAMPAIGNS

A Windows zero-day and a repeatable playbook

Recent reporting shows a disciplined operation that reuses the same chain and occasionally burns a zero-day.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

PixyNetLoader tracking

A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through

Track {{name}} across campaigns, IOCs and infrastructure

This page shows a sample of recent indicators and recent campaigns. Sign up free to pivot through