The Play ransomware gang, also known as Playcrypt, has emerged as a significant threat, breaching approximately 900 organizations across North America, South America, and Europe since its inception in 2022. This figure, updated by the FBI, CISA, and the Australian Cyber Security Centre, marks a substantial increase from the 300 attacks initially reported in 2023. The group has been particularly active in targeting businesses and critical infrastructure, making it one of the most prolific ransomware groups in recent years. Play ransomware operators employ a ransomware-as-a-service (RaaS) model, using recompiled malware in each attack to evade detection by security solutions. They exploit multiple vulnerabilities, such as CVE-2024-57727, in remote monitoring and management tools like SimpleHelp, which has been widely used by U.S.-based victims. The gang’s tactics involve stealing sensitive documents from compromised systems and using them to extort victims, threatening to publish the data on their dark web leak site if ransoms are not paid. Unlike other ransomware operations, Play uses email for negotiations and does not provide victims with a Tor page link. The gang also utilizes a custom VSS Copying Tool to steal files from shadow volume copies, enhancing their data exfiltration capabilities. High-profile victims include cloud computing company Rackspace, the City of Oakland in California, Dallas County, and the doughnut chain Krispy Kreme. CTIX analysts recommend organizations prioritize updating systems, software, and firmware to mitigate the risk of unpatched vulnerabilities being exploited. Implementing multifactor authentication (MFA) across all services, particularly VPNs and accounts with critical access, is also recommended. Additionally, maintaining offline data backups and developing recovery routines are crucial security practices to counteract the Play ransomware threat.