Classic Brechas Mapa Actores TTP Matrix Analitica Alertas CyberNews Arsenal Exploits KillChain Origen SSLBL RansomLook Ransomwhere

Play

0 incidentes 0 paises 0 sectores threat-actor Ultimo: -

Aliases: una reputación de actividad prolongada, arid gopher, arid viper, spyc23, APT BAHAMUT, bisonal, tonto, tontoteam, APT CYBERBIT, APT DARKCARACAL, apt-c-3, apt3, ups, APT HACKINGTEAM, Ke3chang, Mirage, Playful Dragon, Royal APT

Ver en IntelTracker → APTTrail →

Play is a ransomware group that has been active since at least 2022 deploying Playcrypt ransomware against the business, government, critical infrastructure, healthcare, and media sectors in North America, South America, and Europe. Play actors employ a double-extortion model, encrypting systems after exfiltrating data, and are presumed by security researchers to operate as a closed group.

Aliases del actor

una reputación de actividad prolongada arid gopher arid viper spyc23 APT BAHAMUT bisonal tonto tontoteam APT CYBERBIT APT DARKCARACAL apt-c-3 apt3 ups APT HACKINGTEAM Ke3chang Mirage Playful Dragon Royal APT Vixen Panda apt15 APT PKPLUG BackdoorDiplomacy Quarian Turian APT QUASAR APT SPACEPIRATES APT TA2101

Actores similares

apt-bahamutactor · 1 apt-camarodragonactor · 1 apt-cyberbitactor · 1 apt-darkcaracalactor · 1 apt-dragonokactor · 1 apt-hackingteamactor · 1 apt-pkplugactor · 1 apt-quasaractor · 1 apt-sharppandaactor · 1 apt-spacepiratesactor · 1

Canales, DLS e infraestructura asociada

Clasificacion automatica desde IntelTracker/APTTrail/OSINT. Estado real solo si viene indicado por la fuente.

Tipo	Estado	Host / enlace	Title / ultimo titulo
Repositorio	unknown	github.com	Ransomware Group: play
DLS / onion	unknown	j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onion	marktsec
DLS / onion	unknown	k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion	marktsec
DLS / onion	online	mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion	CTI.FYI
DLS / onion	unknown	k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onion	Kuhnline
DLS / onion	unknown	mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion	Kuhnline
DLS / leak site	unknown	ransomware.anggipradana.com	Ransomware Group: playboy
DLS / leak site	unknown	nitter.net	Ido Cohen: Tracking the pulse of ransomware in 2026—these are the groups leading the global attack landscape right now: Qilin – 665 attacks The Gentleman – 453 attacks Akira – 290 attacks DragonForce – 245 attacks INC – 239 attacks Lockbit – 199 attacks Play – 154 attacks CLOP – 127 attacks NightSpire – 115 attacks CoinBase Cartel – 97 attacks Stay ahead of ransomware threats.
X/Twitter	unknown	x.com	Ido Cohen: Stormous is back with increased activity. Recent victims have had their public websites defaced with a ransomware message displayed directly on the homepage—a pressure tactic sometimes used by ransomware groups to increase urgency and force negotiations. DarkFeed makes it easy to compare a ransomware group's leak site with the victim's public website in one place, helping analysts quickly identify attacks like these.
DLS / leak site	unknown	nitter.net	Ido Cohen: Stormous is back with increased activity. Recent victims have had their public websites defaced with a ransomware message displayed directly on the homepage—a pressure tactic sometimes used by ransomware groups to increase urgency and force negotiations. DarkFeed makes it easy to compare a ransomware group's leak site with the victim's public website in one place, helping analysts quickly identify attacks like these.
Repositorio	unknown	github.com	BushidoUK ToolMatrix GroupProfiles: PLAY
Repositorio	up	github.com	BushidoUK ToolMatrix CommunityReports: CR-016-PLAY-APR-2025
Web	unknown	www.cisa.gov	OSINT
Repositorio	up	github.com	BushidoUK ToolMatrix CommunityReports: CR-016-PLAY-APR-2025
X/Twitter	up	x.com	BushidoUK ToolMatrix CommunityReports: CR-016-PLAY-APR-2025
DLS / leak site	up	hijacklibs.net	BushidoUK ToolMatrix CommunityReports: CR-016-PLAY-APR-2025
DLS / leak site	up	www.guidepointsecurity.com	BushidoUK ToolMatrix CommunityReports: CR-016-PLAY-APR-2025
Foro	unknown	www.breachsense.com	playtimemobile.com - RaidForums Data Breach
Foro	unknown	getbootstrap.com	playtimemobile.com - RaidForums Data Breach
Foro	unknown	github.com	playtimemobile.com - RaidForums Data Breach
Foro	unknown	github.com	playtimemobile.com - RaidForums Data Breach
Foro	unknown	github.com	playtimemobile.com - RaidForums Data Breach
DLS / leak site	unknown	duckduckgo.com	The DeBruler
DLS / leak site	unknown	duckduckgo.com	The DeBruler
DLS / onion	offline	mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onion	CTI.FYI
DLS / onion	unknown	ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion	marktsec
Web	unknown	attack.mitre.org	OSINT

Tipo

threat-actor

Pais origen

Motivacion

Impacto

Actualizado

2026-08-03