Play ransomware exploits FortiOS, Exchange, SimpleHelp
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Play ransomware group actively targets critical infrastructure via known FortiOS, Exchange, and RMM vulnerabilities with double extortion model.
Since June 2022, the Play (also known as Playcrypt) ransomware group has conducted widespread attacks across North America, South America, and Europe, impacting approximately 900 entities as of May 2025. The group operates a closed, structured organization employing a double extortion model: exfiltrating data before encrypting systems. Play gains initial access through abuse of valid credentials, exploitation of public-facing applications, and external-facing services including RDP and VPN. Primary vulnerabilities exploited include FortiOS CVE-2018-13379 and CVE-2020-12812, Microsoft Exchange ProxyNotShell CVE-2022-41040 and CVE-2022-41082, and recently SimpleHelp CVE-2024-57727 for remote code execution. The group uses legitimate tools including AdFind, Grixba (custom infostealer), Cobalt Strike, SystemBC, PsExec, Mimikatz, WinPEAS, WinRAR, and WinSCP for reconnaissance, lateral movement, credential dumping, and data exfiltration. Play employs intermittent AES-RSA hybrid encryption, recompiling binaries for each campaign to evade detection. Victims receive unique @gmx.de or @web.de email addresses for ransom negotiations and are threatened with data publication on the group's Tor-based leak site. A dedicated ESXi variant targets virtual machine infrastructure using AES-256 encryption on specific VM file extensions. The group conducts phone-based extortion, calling organizational numbers with threats of data release.
Mentioned in this report
Detection guidance
SimpleHelp winpty Named Pipes Created
Detects creation of winpty named pipes used by the SimpleHelp remote access server/client to spawn terminals, which is relevant to SimpleHelp CVE-2024-57727 abuse and rogue SimpleHelp deployments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SimpleHelp winpty Named Pipes Created
id: 4a2d7ea1-e1c7-5084-a2a8-d210cf2efba1
status: experimental
description: Detects creation of winpty named pipes (conin/conout/control) used by
SimpleHelp to provide remote terminal sessions. Play ransomware operators exploited
SimpleHelp (CVE-2024-57727) for remote code execution and use it for remote access.
Review whether SimpleHelp is a sanctioned tool on the host.
tags:
- attack.initial-access
- attack.t1190
- attack.t1133
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName:
- \winpty-conin-*
- \winpty-conout-*
- \winpty-control-*
condition: selection
falsepositives:
- Legitimate SimpleHelp remote support deployments used by the IT or MSP team
- Other software that bundles the winpty library for terminal emulation
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
Cobalt Strike Default Named Pipes Created
Detects creation of default Cobalt Strike named pipes (WkSvcPipeMgr, MSSE-*-server, hashdump) used for lateral movement and credential dumping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Cobalt Strike Default Named Pipes Created
id: 7cdd80c2-dd2b-510f-84b7-921f6725b142
status: experimental
description: Detects creation of default Cobalt Strike named pipes. Play ransomware
operators use Cobalt Strike for lateral movement and credential dumping. Malleable
profiles can change these names, so absence of a hit does not rule out Cobalt Strike.
tags:
- attack.lateral-movement
- attack.t1570
- attack.credential-access
- attack.t1003
logsource:
category: pipe_created
product: windows
detection:
selection:
PipeName:
- \WkSvcPipeMgr_*
- \MSSE-*-server
- \hashdump
condition: selection
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike profiles
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
Windows Event Log Cleared via Wevtutil or PowerShell
Detects clearing of Windows event logs with wevtutil cl or PowerShell Clear-EventLog, a defense-evasion step commonly seen before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Windows Event Log Cleared via Wevtutil or PowerShell
id: d1b306f3-425b-55e0-ac10-3b65e5877cfe
status: experimental
description: Detects event log clearing through wevtutil.exe (cl / clear-log) or the
PowerShell Clear-EventLog / Remove-EventLog cmdlets. Play ransomware operators clear
Windows event logs to hinder investigation.
tags:
- attack.defense-impairment
- attack.t1685.005
logsource:
category: process_creation
product: windows
detection:
selection_wevtutil:
Image|endswith: \wevtutil.exe
CommandLine|contains:
- ' cl '
- ' clear-log '
selection_ps:
Image|endswith:
- \powershell.exe
- \pwsh.exe
CommandLine|contains:
- Clear-EventLog
- Remove-EventLog
condition: 1 of selection_*
falsepositives:
- Administrators clearing logs during troubleshooting or image preparation
- Golden image or lab reset scripts that clear logs before sealing
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
1 more detection for this report is in the app — the rules that match its indicators, plus the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. Three days of it free, no card.
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,853 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs