StopRansomware: Play Ransomware

The Play ransomware group has been active since June 2022, targeting businesses and critical infrastructure in North America, South America, and Europe. They gain access by exploiting vulnerabilities, using stolen credentials, and leveraging remote access services. Their attacks follow a double extortion model, encrypting systems after exfiltrating data using AES-RSA hybrid encryption. The group employs various tools for network discovery, credential theft, and lateral movement. Organizations are advised to implement multifactor authentication, regular patching, network segmentation, and maintain offline backups to reduce risk.

• CVE-2024-57727: SimpleHelp · n/aCriticalVulnerability2025-01-15
• CVE-2022-41040: Microsoft Exchange Server Server-Side Request Forgery VulnerabilityHighVulnerability2022-09-30
• CVE-2022-41082: Microsoft Exchange Server Remote Code Execution VulnerabilityHighVulnerability2022-09-30
• CVE-2018-13379: Fortinet FortiOS SSL VPN Path Traversal VulnerabilityCriticalVulnerability2021-11-03
• CVE-2020-12812: Fortinet FortiOS SSL VPN Improper Authentication VulnerabilityHighVulnerability2021-11-03