# Play ransomware exploits FortiOS, Exchange, SimpleHelp

Published: 2025-07-14 · Severity: severe · Sectors: defense, energy, government-national, healthcare, infrastructure, manufacturing, technology, telecommunications
Canonical: https://vorant.io/reports/bb9f5744-e373-5cc2-904c-36b68d8d476c/play-ransomware-exploits-fortios-exchange-simplehelp

> Play ransomware group actively targets critical infrastructure via known FortiOS, Exchange, and RMM vulnerabilities with double extortion model.

Since June 2022, the Play (also known as Playcrypt) ransomware group has conducted widespread attacks across North America, South America, and Europe, impacting approximately 900 entities as of May 2025. The group operates a closed, structured organization employing a double extortion model: exfiltrating data before encrypting systems. Play gains initial access through abuse of valid credentials, exploitation of public-facing applications, and external-facing services including RDP and VPN. Primary vulnerabilities exploited include FortiOS CVE-2018-13379 and CVE-2020-12812, Microsoft Exchange ProxyNotShell CVE-2022-41040 and CVE-2022-41082, and recently SimpleHelp CVE-2024-57727 for remote code execution. The group uses legitimate tools including AdFind, Grixba (custom infostealer), Cobalt Strike, SystemBC, PsExec, Mimikatz, WinPEAS, WinRAR, and WinSCP for reconnaissance, lateral movement, credential dumping, and data exfiltration. Play employs intermittent AES-RSA hybrid encryption, recompiling binaries for each campaign to evade detection. Victims receive unique @gmx.de or @web.de email addresses for ransom negotiations and are threatened with data publication on the group's Tor-based leak site. A dedicated ESXi variant targets virtual machine infrastructure using AES-256 encryption on specific VM file extensions. The group conducts phone-based extortion, calling organizational numbers with threats of data release.

## Mentioned in this report

- Vulnerabilities: CVE-2018-13379 (KEV), CVE-2020-12812 (KEV), CVE-2022-41040 (KEV), CVE-2022-41082 (KEV), CVE-2024-57727 (KEV)
- Threat actors: Play
- Malware: Grixba, PLAY

## Detection guidance (public sample)

### SimpleHelp winpty Named Pipes Created

ATT&CK: T1190

Detects creation of winpty named pipes used by the SimpleHelp remote access server/client to spawn terminals, which is relevant to SimpleHelp CVE-2024-57727 abuse and rogue SimpleHelp deployments. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: SimpleHelp winpty Named Pipes Created
id: 4a2d7ea1-e1c7-5084-a2a8-d210cf2efba1
status: experimental
description: Detects creation of winpty named pipes (conin/conout/control) used by
  SimpleHelp to provide remote terminal sessions. Play ransomware operators exploited
  SimpleHelp (CVE-2024-57727) for remote code execution and use it for remote access.
  Review whether SimpleHelp is a sanctioned tool on the host.
tags:
- attack.initial-access
- attack.t1190
- attack.t1133
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \winpty-conin-*
    - \winpty-conout-*
    - \winpty-control-*
  condition: selection
falsepositives:
- Legitimate SimpleHelp remote support deployments used by the IT or MSP team
- Other software that bundles the winpty library for terminal emulation
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
```

### Cobalt Strike Default Named Pipes Created

ATT&CK: T1570

Detects creation of default Cobalt Strike named pipes (WkSvcPipeMgr, MSSE-*-server, hashdump) used for lateral movement and credential dumping. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Cobalt Strike Default Named Pipes Created
id: 7cdd80c2-dd2b-510f-84b7-921f6725b142
status: experimental
description: Detects creation of default Cobalt Strike named pipes. Play ransomware
  operators use Cobalt Strike for lateral movement and credential dumping. Malleable
  profiles can change these names, so absence of a hit does not rule out Cobalt Strike.
tags:
- attack.lateral-movement
- attack.t1570
- attack.credential-access
- attack.t1003
logsource:
  category: pipe_created
  product: windows
detection:
  selection:
    PipeName:
    - \WkSvcPipeMgr_*
    - \MSSE-*-server
    - \hashdump
  condition: selection
falsepositives:
- Red team or penetration test exercises using default Cobalt Strike profiles
level: high
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
```

### Windows Event Log Cleared via Wevtutil or PowerShell

ATT&CK: T1685.005

Detects clearing of Windows event logs with wevtutil cl or PowerShell Clear-EventLog, a defense-evasion step commonly seen before ransomware encryption. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Windows Event Log Cleared via Wevtutil or PowerShell
id: d1b306f3-425b-55e0-ac10-3b65e5877cfe
status: experimental
description: Detects event log clearing through wevtutil.exe (cl / clear-log) or the
  PowerShell Clear-EventLog / Remove-EventLog cmdlets. Play ransomware operators clear
  Windows event logs to hinder investigation.
tags:
- attack.defense-impairment
- attack.t1685.005
logsource:
  category: process_creation
  product: windows
detection:
  selection_wevtutil:
    Image|endswith: \wevtutil.exe
    CommandLine|contains:
    - ' cl '
    - ' clear-log '
  selection_ps:
    Image|endswith:
    - \powershell.exe
    - \pwsh.exe
    CommandLine|contains:
    - Clear-EventLog
    - Remove-EventLog
  condition: 1 of selection_*
falsepositives:
- Administrators clearing logs during troubleshooting or image preparation
- Golden image or lab reset scripts that clear logs before sealing
level: medium
author: Vorant
references:
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

1 more detection for this report is in the app: the rules that match its indicators, the Sigma rules already converted to Splunk SPL, to Elastic where their fields map onto Elastic's integrations and to Microsoft Defender XDR KQL wherever Defender records the activity, and the YARA and Suricata. A new account gets three days of them free.

Source reporting: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/bb9f5744-e373-5cc2-904c-36b68d8d476c/play-ransomware-exploits-fortios-exchange-simplehelp.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup