{
  "slug": "play",
  "group": "play",
  "name": "Play",
  "note": null,
  "attck": [
    {
      "id": "G1040",
      "name": "Play",
      "kind": "intrusion-set",
      "url": "https://attack.mitre.org/groups/G1040"
    },
    {
      "id": "S1162",
      "name": "Playcrypt",
      "kind": "malware",
      "url": "https://attack.mitre.org/software/S1162"
    }
  ],
  "activity": {
    "postings": 48,
    "first": "2026-08-17",
    "last": "2026-11-04",
    "countries": {
      "AR": 1,
      "US": 24,
      "CA": 5,
      "??": 5,
      "DK": 1,
      "BE": 1,
      "HK": 1,
      "DE": 4,
      "GB": 1,
      "MN": 1,
      "BR": 1,
      "IE": 1,
      "RS": 1,
      "LV": 1
    },
    "sectors": {
      "manufacturing": 12,
      "finance": 5,
      "technology": 10,
      "transportation": 1,
      "consumer": 4,
      "services": 5,
      "healthcare": 2,
      "unknown": 5,
      "agriculture": 3,
      "energy": 1
    },
    "recent": [
      {
        "date": "2026-11-04",
        "name": "Aripack",
        "country": "AR",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/QXJpcGFja0BwbGF5"
      },
      {
        "date": "2026-11-04",
        "name": "StrucSure Home Warranty",
        "country": "US",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/U3RydWNTdXJlIEhvbWUgV2FycmFudHlAcGxheQ"
      },
      {
        "date": "2026-11-04",
        "name": "Standard Sand & Silica",
        "country": "US",
        "sectors": [
          "manufacturing"
        ],
        "url": "https://www.ransomware.live/id/U3RhbmRhcmQgU2FuZCAmIFNpbGljYUBwbGF5"
      },
      {
        "date": "2026-11-04",
        "name": "Misura",
        "country": "CA",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/TWlzdXJhQHBsYXk"
      },
      {
        "date": "2026-11-04",
        "name": "AVIR",
        "country": "??",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/QVZJUkBwbGF5"
      },
      {
        "date": "2026-10-27",
        "name": "Tailormade Logistics",
        "country": "DK",
        "sectors": [
          "transportation"
        ],
        "url": "https://www.ransomware.live/id/VGFpbG9ybWFkZSBMb2dpc3RpY3NAcGxheQ"
      },
      {
        "date": "2026-10-27",
        "name": "Coast 2 Coast",
        "country": "US",
        "sectors": [
          "consumer"
        ],
        "url": "https://www.ransomware.live/id/Q29hc3QgMiBDb2FzdEBwbGF5"
      },
      {
        "date": "2026-10-27",
        "name": "VPC Builders",
        "country": "US",
        "sectors": [
          "services"
        ],
        "url": "https://www.ransomware.live/id/VlBDIEJ1aWxkZXJzQHBsYXk"
      },
      {
        "date": "2026-10-27",
        "name": "Hygiena",
        "country": "US",
        "sectors": [
          "healthcare"
        ],
        "url": "https://www.ransomware.live/id/SHlnaWVuYUBwbGF5"
      },
      {
        "date": "2026-10-27",
        "name": "Money Concepts Capital",
        "country": "US",
        "sectors": [
          "finance"
        ],
        "url": "https://www.ransomware.live/id/TW9uZXkgQ29uY2VwdHMgQ2FwaXRhbEBwbGF5"
      },
      {
        "date": "2026-10-27",
        "name": "MicroSearch",
        "country": "??",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/TWljcm9TZWFyY2hAcGxheQ"
      },
      {
        "date": "2026-10-27",
        "name": "QLC",
        "country": "US",
        "sectors": [
          "technology"
        ],
        "url": "https://www.ransomware.live/id/UUxDQHBsYXk"
      }
    ]
  },
  "convergences": [],
  "reports": [
    {
      "url": "https://www.intel471.com/blog/a-new-era-of-bulletproof-hosting-providers-emerge",
      "publisher": "Intel 471",
      "published": "2026-08-19",
      "title": "A New Era of Bulletproof Hosting Providers Emerge",
      "origin": "feed",
      "primary": false
    }
  ],
  "techniques": [
    {
      "id": "T1003.001",
      "name": "LSASS Memory",
      "tactics": [
        "credential-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 79,
      "related": 36
    },
    {
      "id": "T1016",
      "name": "System Network Configuration Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 11,
      "related": 0
    },
    {
      "id": "T1018",
      "name": "Remote System Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 0
    },
    {
      "id": "T1021.002",
      "name": "SMB/Windows Admin Shares",
      "tactics": [
        "lateral-movement"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 38,
      "related": 10
    },
    {
      "id": "T1027.010",
      "name": "Command Obfuscation",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 10,
      "related": 94
    },
    {
      "id": "T1030",
      "name": "Data Transfer Size Limits",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 2,
      "related": 0
    },
    {
      "id": "T1048",
      "name": "Exfiltration Over Alternative Protocol",
      "tactics": [
        "exfiltration"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 12,
      "related": 10
    },
    {
      "id": "T1057",
      "name": "Process Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 0
    },
    {
      "id": "T1059.001",
      "name": "PowerShell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 220,
      "related": 94
    },
    {
      "id": "T1059.003",
      "name": "Windows Command Shell",
      "tactics": [
        "execution"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 46,
      "related": 94
    },
    {
      "id": "T1070.004",
      "name": "File Deletion",
      "tactics": [
        "stealth"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 15,
      "related": 20
    },
    {
      "id": "T1078",
      "name": "Valid Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 55,
      "related": 54
    },
    {
      "id": "T1078.002",
      "name": "Domain Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 55
    },
    {
      "id": "T1078.003",
      "name": "Local Accounts",
      "tactics": [
        "stealth",
        "persistence",
        "privilege-escalation",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 5,
      "related": 55
    },
    {
      "id": "T1082",
      "name": "System Information Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 33,
      "related": 0
    },
    {
      "id": "T1083",
      "name": "File and Directory Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 24,
      "related": 0
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactics": [
        "command-and-control"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1204-004-clickfix-run-dialog-execution"
      ],
      "community": 87,
      "related": 0
    },
    {
      "id": "T1133",
      "name": "External Remote Services",
      "tactics": [
        "persistence",
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 20,
      "related": 0
    },
    {
      "id": "T1190",
      "name": "Exploit Public-Facing Application",
      "tactics": [
        "initial-access"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [
        "t1190-peoplesoft-psemhub-encoded-path-exploitation"
      ],
      "community": 147,
      "related": 0
    },
    {
      "id": "T1486",
      "name": "Data Encrypted for Impact",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 16,
      "related": 0
    },
    {
      "id": "T1490",
      "name": "Inhibit System Recovery",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 27,
      "related": 0
    },
    {
      "id": "T1518.001",
      "name": "Security Software Discovery",
      "tactics": [
        "discovery"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 4
    },
    {
      "id": "T1560.001",
      "name": "Archive via Utility",
      "tactics": [
        "collection"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 17,
      "related": 4
    },
    {
      "id": "T1587.001",
      "name": "Malware",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 11,
      "related": 6
    },
    {
      "id": "T1588.002",
      "name": "Tool",
      "tactics": [
        "resource-development"
      ],
      "sources": [
        "attck"
      ],
      "structural": true,
      "own": [],
      "community": 9,
      "related": 2
    },
    {
      "id": "T1657",
      "name": "Financial Theft",
      "tactics": [
        "impact"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 0,
      "related": 0
    },
    {
      "id": "T1685",
      "name": "Disable or Modify Tools",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 162,
      "related": 44
    },
    {
      "id": "T1685.005",
      "name": "Clear Windows Event Logs",
      "tactics": [
        "defense-impairment"
      ],
      "sources": [
        "attck"
      ],
      "structural": false,
      "own": [],
      "community": 8,
      "related": 162
    }
  ],
  "cves": [],
  "indicators": {
    "list": [],
    "withheld": 0
  },
  "rules": [],
  "coverage": {
    "techniques": 28,
    "defendable": 26,
    "covered": 25,
    "uncovered": [
      "T1657"
    ]
  }
}