Play ransomware group hit 900 organizations since 2022
Security Affairs
JUNE 6, 2025
The Play ransomware group has been active since June 2022, the list of victims includes the City of Oakland , the Cloud services provider Rackspace , and the Dutch maritime logistics company Royal Dirkzwager. By stealing credentials with Mimikatz and escalating privileges with WinPEAS, they spread malware via Group Policy Objects. .
Let's personalize your content