Ransomware Play

 

About

The Play ransomware, also known as Playcrypt, is a fast-growing ransomware group that targeted a variety of organizations across the world. They sat-up a cyberattack campaign distributing ransomware to their downstream customers. They targeted many mid-sized businesses in the finance, legal, software, shipping, law enforcement, and logistics sectors of the US, Australia, UK, Italy, and other countries. Reportedly, they are also targeting state, local, and tribal entities of these countries. 

Since 2022, Play has targeted a wide range of victims. By 2023, the FBI became aware of approximately 300 affected entities allegedly exploited by this ransomware. 

According this ransomware group's website, it is presumably a closed group, "designed to guarantee the secrecy of deals." They employ a double-extortion model, encrypting systems after exfiltrating data. They do not demand any initial ransom or include any payment instructions, instead, they simply instructs their victims to contact the threat actors via email. 

To increase the trouble, Play uses intermittent encryption, encrypting only some parts of a file, to avoid early detection. 

Attack Method

The threat actors abuse valid accounts and exploit public-facing applications to gain initial access. They might also use external-facing services like Remote Desktop Protocol (RDP) and Virtual Private Network (VPN) to gain the access. After that, they make use of command and control applications, to assist with lateral movement and file execution. Once established, they search for vulnerable credentials to use Mimikatz credential dumper for domain administrator access. Since, the search for vulnerabilities is successful, they can now distribute executables via Group Policy Objects. 

Protection

Play can exploit a wide range of vulnerabilities along with the various attack vectors. Hence, defending against its attack requires a multi-pronged strategy. Some of the strategies that can be implemented are: 

• Monitor Network- This can offer early warning of an attack. Monitoring network means keeping a close eye on the network traffic for any unusual or suspicious activity. It helps in detecting the threat actor in early stages before it can cause significant damage to the system.

• Detect Anomaly- It is a more advanced form of network monitoring. It specifically keep an eye on the abnormal deviations from the usual behavior. It is very much helpful in detecting the stealthy ransomware, that may not trigger the traditional security alerts.

• Access Control and Network Segmentation- It is also an effective defense system. As the name suggests, it divides the network into separate segments to limit the spread of an attack. It hinders the attacker from easily moving onto the other parts of the network, even if one segment is compromised. 

• Access Control- It can strictly control who can have access and to what extent. It means implementing the Principle of Least Privilege (PoLP), in which users are granted necessary privileges only, to complete their tasks. 

• Threat Hunting- It means searching for the threats that may have escaped the existing security measures. Regular threat hunting is helpful in identifying the signs of Play as well as the other malicious threat groups. 

• Incident Response- This is used after the successful detection of a threat actor. A nicely prepared incident response plan can help in mitigating the effects of Play. This plan must include the steps to be taken after a security incident, like how to isolate the affected systems, how to remove the threat, and how to restore normal operations. 

• Managed Detection and Response (MDR)- This approach combines technology and human expertise. It can easily identify a threat actor according to its known characteristics and behaviors. After that, MDR acts swiftly to mitigate the effects of the attack to stop any further quick damages to the system. It can also offer an expert advise and guidance, that can help immensely in planning an effective defense strategy.