Threat Research

Updated Response to CISA Advisory (AA23-352A): #StopRansomware: Play Ransomware

AttackIQ
Updated Response to CISA Advisory (AA23-352A): #StopRansomware: Play Ransomware

The Cybersecurity and Infrastructure Security Agency (CISA), FBI, and Australian Cyber Security Centre (ACSC) released an updated advisory detailing the Tactics, Techniques, and Procedures (TTPs) and Indicators of Compromise (IOCs) related to the Play ransomware group, active since 2022 and responsible for widespread attacks. The advisory includes new behaviors such as the use of custom tools like Grixba and AlphaVSS, double extortion strategies, and overlaps with other ransomware groups, supported by a detailed attack graph to aid defenders. #PlayRansomware #Grixba #AlphaVSS #CobaltStrike

Keypoints

  • The Play ransomware group, active since June 2022, targets diverse entities across multiple continents and employs a closed affiliate model emphasizing secrecy.
  • Recent updates to Play’s TTPs include exploitation of ProxyNotShell, OWASSRF vulnerabilities, and use of custom tools like Grixba (information stealer) and AlphaVSS (VSS utility).
  • Play uses a double extortion tactic with data exfiltration preceding file encryption and threatens victims via email and sometimes phone calls to enforce ransom compliance.
  • The group shares technical infrastructure with Quantum ransomware and exhibits overlaps with Hive and Nokoyawa ransomware, including the use of Cobalt Strike beacons with a known watermark ID.
  • A detailed attack graph published by AttackIQ simulates Play ransomware behaviors across stages including execution, discovery, credential access, privilege escalation, defense evasion, exfiltration, and impact.
  • Key MITRE ATT&CK techniques such as Scheduled Task abuse, LSASS memory dumping, and disabling Microsoft Defender are highlighted, with detection and mitigation guidance provided.
  • Organizations are advised to prioritize defense strategies around scheduled task detection and file encryption prevention to mitigate Play ransomware risks effectively.

MITRE Techniques

  • [T1105] Ingress Tool Transfer – Used to download and save malicious tools like Grixba, NetScan, Mimikatz, WinPEAS, Cobalt Strike, SystemBC, Play ransomware, and AlphaVSS to test endpoint defenses. (‘downloads to memory and saves to disk’)
  • [T1497] Virtualization/Sandbox Evasion – Executes IsDebuggerPresent Windows API to detect debugger presence and evade analysis. (‘execute the IsDebuggerPresent Windows API’)
  • [T1012] Query Registry – Queries MachineGUID and current user Windows properties from registry keys for system identification. (‘queries MachineGUID and Windows properties keys’)
  • [T1033] System Owner/User Discovery – Retrieves username of the current thread via GetUserNameA API. (‘executes GetUserNameA Windows API call’)
  • [T1057] Process Discovery – Lists running processes using Windows Management Instrumentation commands. (‘executes Process WMI command’)
  • [T1007] System Service Discovery – Gathers information about configured services using Windows API such as EnumServiceStatus and QueryServiceStatusEx. (‘executes EnumServiceStatus, QueryServiceStatusEx APIs’)
  • [T1018] Remote System Discovery – Uses nltest and AdFind utilities to enumerate domain controllers, trusted domains, and Active Directory details. (‘executes nltest and AdFind commands’)
  • [T1482] Domain Trust Discovery – Calls nltest with /trusteddomains to list Active Directory trusted domains. (‘calls nltest with /trusteddomains’)
  • [T1003] OS Credential Dumping – Employs obfuscated Mimikatz to dump credentials and hashes; dumps LSASS memory to a minidump file for further extraction. (‘uses obfuscated Mimikatz and dumps LSASS process’)
  • [T1053.005] Scheduled Task/Job: Scheduled Task – Creates scheduled tasks via schtasks utility to execute ransomware payloads. (‘creation of scheduled task using schtasks’)
  • [T1021.001] Remote Services: Remote Desktop Protocol – Attempts lateral movement through RDP connections. (‘remotely connects via RDP’)
  • [T1562.001] Impair Defenses: Disable or Modify Tools – Uses PowerShell’s Set-MpPreference to disable Microsoft Defender monitoring features. (‘modifies DisableRealtimeMonitoring and DisableBehaviorMonitoring’)
  • [T1070.001] Indicator Removal: Clear Windows Event Logs – Clears event logs via wevtutil to hinder forensic analysis. (‘executes wevtutil to delete logs’)
  • [T1048.002] Exfiltration Over Asymmetric Encrypted Non-C2 Protocol – Exfiltrates data over Secure File Transfer Protocol (SFTP). (‘exfiltrates collected information over SFTP’)
  • [T1083] File and Directory Discovery – Enumerates the file system using FindFirstFileW and FindNextFileW Windows API calls before encryption. (‘executes FindFirstFileW and FindNextFileW to enumerate files’)
  • [T1486] Data Encrypted for Impact – Encrypts targeted files in place using AES and RSA encryption algorithms. (‘encrypting files using AES and RSA’)

Indicators of Compromise

  • [Email Addresses] Play ransomware victim contact methods – unique @gmx.de and @web.de addresses used for ransom negotiations.
  • [File Hashes] Known malicious payloads including Grixba stealer samples, NetScan, Mimikatz, WinPEAS, Cobalt Strike, SystemBC backdoor, Play ransomware binaries, and AlphaVSS tool – multiple hashes reported.
  • [Commands/Tools] Use of schtasks for scheduled tasks, nltest and AdFind for Active Directory enumeration, and PowerShell commands to disable Microsoft Defender and clear event logs.

Read more: https://www.attackiq.com/2025/06/12/updated-response-to-cisa-advisory-aa23-352a/

SHARE THIS STORY

WhatsAppX (Twitter)TelegramBlueskyFacebookLinkedInThreadsEmailPrint