Tag: play

5 Attack Reports | 0 Vulnerabilities

Attack reports

May 2025 Security Issues in Korean & Global Financial Sector

This comprehensive analysis covers cyber threats targeting financial companies in Korea and globally. It examines malware and phishing cases, top 10 malware strains, and statistics on leaked Korean accounts. The report delves into major financial threats on the dark web, including credit card data …
ransomware
lockbit
data breach
identity theft
play
dark web
2025-06-13
customer data
brokerage
arkana
safepay
Published: June 13, 2025
Downloadable IOCs: 0

StopRansomware: Play Ransomware

The Play ransomware group has been actively targeting businesses and critical infrastructure across North America, South America, and Europe since June 2022. They gain initial access through exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. The group emplo…
ransomware
systembc
grixba
play
CVE-2024-57727
2025-06-05
CVE-2022-41040
CVE-2022-41082
CVE-2018-13379
CVE-2020-12812
Published: June 5, 2025
Linked vulnerabilities : CVE-2024-57727 (CVSS 7.5), CVE-2022-41082, CVE-2022-41040, CVE-2020-12812, CVE-2018-13379
Downloadable IOCs: 8

Shifting the sands of RansomHub's EDRKillShifter

ESET researchers analyze the ransomware ecosystem in 2024, focusing on the newly emerged RansomHub gang. They uncover connections between RansomHub affiliates and rival gangs Play, Medusa, and BianLian through the use of EDRKillShifter, a custom EDR killer developed by RansomHub. The researchers le…
ransomware
bianlian
medusa
edrkillshifter
systembc
grixba
byovd
play
2025-03-27
scransom
Published: March 27, 2025
Downloadable IOCs: 0

Play Ransomware impersonates SentinelOne for stealth recon

A Play ransomware attack involving a reconnaissance tool called Grixba was detected and prevented. The attack began with the deployment of Grixba via RDP to a Windows server. The Grixba file was disguised as legitimate SentinelOne software, a new tactic for the group. Grixba is an obfuscated .NET-b…
obfuscation
ransomware
.net
rdp
reconnaissance
grixba
play
2025-01-17
sentinelone impersonation
xor encryption
Published: January 17, 2025
Downloadable IOCs: 4

Play Ransomware Engagement

Unit 42 has identified Jumpy Pisces, a North Korean state-sponsored threat group, as a key player in a recent ransomware incident. The group appears to be collaborating with the Play ransomware group, marking a shift in their tactics. This is the first observed instance of Jumpy Pisces using existi…
north korea
sliver
mimikatz
dtrack
2024-10-30
play
reconnaissance general bureau
initial access broker
korean people's army
fiddling scorpius
play ransomware
Published: October 30, 2024
Downloadable IOCs: 0
Click here to see more Attack Reports