Play Ransomware Decryption & Data Recovery

Play (also PlayCrypt; Symantec tracks the operators as Balloonfly) first appeared in June 2022, named after the uniform .play extension and the single word in its ransom note. Unlike openly recruiting RaaS operations such as Akira, Qilin and RansomHub, CISA assesses Play as a closed group — no public affiliate recruitment, tooling and infrastructure kept in-house. Its tradecraft has therefore stayed remarkably consistent, which makes family-driven response unusually effective here.

CISA, the FBI and Australia's ACSC published the #StopRansomware advisory AA23-352A in December 2023 and updated it on 4 June 2025, reporting roughly 900 victim organisations as of May 2025 across businesses and critical infrastructure in North America, South America and Europe, with notable impact on government and police networks in Latin America. In April 2024 Play was briefly the most prolific ransomware group of the month, and it remains on active-family lists through 2026.

Two technical points matter for regional enterprises. First, per-victim recompilation: Play builds a fresh encryptor for each attack, so every sample hash is unique and both hash-based blocklists and "we run antivirus" assumptions fail. Second, full ESXi capability: in July 2024 Trend Micro documented a Linux variant purpose-built for VMware ESXi, using AES-256 against .vmdk, .vmem, .vmsd, .vmsn, .vmx, .vswp and .nvram files and dropping notes under /vmfs/volumes — squarely against the consolidated virtualisation designs common in manufacturing and hospitals.

Play also has a distinctive coercion habit: some victims receive phone calls from the attackers threatening to publish data. Offline pressure layered on double extortion tends to force decisions before technical assessment is complete, which is why establishing a "no payment, no unilateral contact" policy in advance matters here more than usual.

Extension. Encrypted files uniformly gain .play (some samples show uppercase .PLAY), with no per-file variation — Play's most immediate signature.

Ransom note. The file is ReadMe.txt, typically in C:\Users\Public\Music rather than scattered through every directory. Content is minimal: usually the single word "PLAY" plus a @gmx.de or @web[.]de address, unique per victim. The combination of a German free-mail address with near-empty text distinguishes Play clearly from other families.

Host-side artefacts.

• The encryptor is recompiled for every attack, so sample hashes are unique — hash matching will not identify it.
• Common tooling: Cobalt Strike, SystemBC (proxy and persistence), PsExec, AdFind, Mimikatz, WinRAR, WinSCP.
• GMER, IOBit and PowerTool-class utilities used to disable security software, plus the custom infostealer Grixba to enumerate security products, backup software and remote-access tools.
• Volume shadow copies deleted; bulk-execution traces across the domain (Group Policy, PsExec, scheduled tasks).

Virtualisation artefacts. On ESXi, guests go offline en masse, .vmdk/.vmem/.vmsn files are encrypted, ransom notes appear under /vmfs/volumes and in the ESXi root, and in some cases the ESXi login banner is modified to display the ransom message.

Offline signal. Staff or executives receiving calls or voicemails from the attackers threatening publication — markedly more common in Play cases than in other families.

Play depends heavily on exposed edge devices and remote access, and has concentrated on a small set of known vulnerabilities for years — which is good news for defenders, because the self-check list is concrete.

1. FortiOS flaws: CVE-2018-13379 (path traversal leaking credentials) and CVE-2020-12812 (SSL VPN second-factor bypass). Both are years old and still exploited repeatedly, indicating large numbers of unpatched devices.

2. Microsoft Exchange ProxyNotShell: CVE-2022-41040 chained with CVE-2022-41082 to land directly on Exchange.

3. Remote-support software flaws: the 2025 advisory update added SimpleHelp CVE-2024-57727, which Play used to reach downstream organisations through MSP and operations channels.

4. Valid RDP and VPN accounts: logging in with leaked or brute-forced credentials, with almost no friction where MFA is absent.

The post-compromise chain is stable:

• domain enumeration with AdFind, inventory of security and backup software with Grixba, credential theft with Mimikatz;
• Cobalt Strike and SystemBC for persistence and proxying;
• GMER/IOBit/PowerTool to disable antivirus and EDR;
• staging with WinRAR and exfiltration over WinSCP to set up double extortion;
• domain-wide deployment of the individually compiled encryptor via PsExec, Group Policy or scheduled tasks, with the Linux variant pushed to ESXi.

Because the toolchain is fixed, detections for SystemBC, Grixba, GMER driver loading and bulk WinSCP egress frequently catch Play before encryption begins.

Algorithms. A hybrid AES plus RSA scheme: file data encrypted with AES, and the AES key wrapped under the operators' RSA public key and stored with the file. The ESXi variant uses AES-256 for virtual-machine files.

Intermittent encryption. The CISA advisory records it explicitly: Play encrypts intermittently, processing files in 0x100000-byte (1 MB) units and skipping system files. For large files — VMDKs, database mdf/ndf/dbf/ibd files, archives — only part of the data is AES-covered while the rest remains usable original data. That is how Play finishes an entire domain and virtualisation cluster quickly, and it is the most practical opening for .play file recovery. Actual coverage depends on build and parameters and must be measured per case.

Per-victim compilation. The encryptor is rebuilt for every attack and every hash is unique. This affects detection and attribution, not the recovery method itself.

Destructive actions.

• Deletes volume shadow copies.
• Stops database, backup-agent and security services, using GMER/IOBit-class tools to unload protection where needed.
• On ESXi, walks /vmfs/volumes encrypting virtual-machine files (.vmdk, .vmem, .vmsd, .vmsn, .vmx, .vmxf, .vswp, .vmss, .nvram, .vmtx, .log) and writes notes in the root and volume directories.
• Clears selected log artefacts.

Double extortion. Data is staged with WinRAR and exfiltrated over WinSCP before encryption; non-payers are posted to the leak site, reinforced by phone calls.