Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Hunt / play

Play

G1040 PlayS1162 Playcrypt

48victims, 90d
Nov 4last post
0reports about them
25/26techniques with a rule
0indicators

Who they hit

  • Manufacturing12
  • Technology10
  • Finance5
  • Professional services5
  • Unclassified5
  • Retail & consumer4
  • US24
  • CA5
  • ??5
  • DE4
  • AR1
  • DK1
PostedVictimCountrySector
2026-11-04AripackARManufacturing
2026-11-04StrucSure Home WarrantyUSFinance
2026-11-04Standard Sand & SilicaUSManufacturing
2026-11-04MisuraCATechnology
2026-11-04AVIR??Technology
2026-10-27Tailormade LogisticsDKTransportation
2026-10-27Coast 2 CoastUSRetail & consumer
2026-10-27VPC BuildersUSProfessional services
2026-10-27HygienaUSHealthcare
2026-10-27Money Concepts CapitalUSFinance
2026-10-27MicroSearch??Technology
2026-10-27QLCUSTechnology

Latest 12 of 48, from ransomware.live. These are the group's claims.

What they do

28 techniques, in kill-chain order. 1 have no rule anywhere we can find. "Their side" is infrastructure work you can't see from your network.

IDTechniqueSourceSigmaHQStatus
T1587.001 Malware mitre 11 their side
T1588.002 Tool mitre 9 their side
T1078 Valid Accounts mitre 55 SigmaHQ
T1078.002 Domain Accounts mitre 5 SigmaHQ
T1078.003 Local Accounts mitre 5 SigmaHQ
T1133 External Remote Services mitre 20 SigmaHQ
T1190 Exploit Public-Facing Application mitre 147 thrunt
T1059.001 PowerShell mitre 220 SigmaHQ
T1059.003 Windows Command Shell mitre 46 SigmaHQ
T1003.001 LSASS Memory mitre 79 SigmaHQ
T1016 System Network Configuration Discovery mitre 11 SigmaHQ
T1018 Remote System Discovery mitre 17 SigmaHQ
T1057 Process Discovery mitre 8 SigmaHQ
T1082 System Information Discovery mitre 33 SigmaHQ
T1083 File and Directory Discovery mitre 24 SigmaHQ
T1518.001 Security Software Discovery mitre 8 SigmaHQ
T1021.002 SMB/Windows Admin Shares mitre 38 SigmaHQ
T1560.001 Archive via Utility mitre 17 SigmaHQ
T1105 Ingress Tool Transfer mitre 87 thrunt
T1030 Data Transfer Size Limits mitre 2 SigmaHQ
T1048 Exfiltration Over Alternative Protocol mitre 12 SigmaHQ
T1486 Data Encrypted for Impact mitre 16 SigmaHQ
T1490 Inhibit System Recovery mitre 27 SigmaHQ
T1657 Financial Theft mitre nothing
T1027.010 Command Obfuscation mitre 10 SigmaHQ
T1070.004 File Deletion mitre 15 SigmaHQ
T1685 Disable or Modify Tools mitre 162 SigmaHQ
T1685.005 Clear Windows Event Logs mitre 8 SigmaHQ

SigmaHQ counts are rules tagged with that exact technique; "~n" is rules on its parent or sub-techniques. A close match does not mean the technique is covered.

Rules to deploy

Ours on the same techniques but written for something else, so check the logic fits before you lean on them: t1204-004-clickfix-run-dialog-execution, t1190-peoplesoft-psemhub-encoded-path-exploitation.

Sweep

No indicators. Either nobody has published any for Play, or the reports cite values without marking them as IOCs. package.json