binarypublish
- The FBI reports that the Play ransomware gang has breached approximately 300 organizations, including critical infrastructure entities, globally between June 2022 and October 2023.
- A joint advisory warning has been issued in partnership with the Cybersecurity and Infrastructure Security Agency (CISA) and the Australian Signals Directorate’s Australian Cyber Security Centre (ASD’s ACSC).
- High-profile victims of Play ransomware include the City of Oakland in California, car retailer Arnold Clark, cloud computing firm Rackspace, and the Belgian city of Antwerp.
- The authorities advise organizations to prioritize addressing known vulnerabilities, implement multifactor authentication (MFA) across all services and regularly update and patch software and applications.
Play ransomware surfaced in June 2022, causing significant impacts to businesses and critical infrastructure in North America, South America, and Europe. Unlike typical ransomware operations, the Play ransomware affiliates use email communication for negotiations, rather than providing Tor negotiations page link in ransom notes left on compromised systems. However, the gang still employs strategies commonly associated with ransomware, such as stealing sensitive documents from compromised systems to pressure victims into paying ransom demands under the threat of leaking the stolen data online.
According to the joint advisory issued by the FBI, CISA, and ASD’s ACSC, organizations are urged to cover their vulnerabilities that have been previously exploited to diminish the likelihood of falling a victim to Play ransomware attacks. Entities are advised to focus particularly on implementing MFA for webmail, VPN, and accounts with access to critical systems. The advisory also presses on the importance of regular updates and patches, alongside routine vulnerability assessments.
High-profile victims of the ransomware attacks include the likes of the City of Oakland (California), car retailer Arnold Clark, cloud computing company Rackspace, and the Belgian city of Antwerp. The Play gang also uses a custom VSS Copying Tool to aid in stealing files from shadow volume copies, even when the files are being used by applications.
In conclusion, the three government agencies encourage organizations to take heed of their advisory’s recommendations, which include maintaining offline backups of data, applying a recovery plan, and always keeping all operating systems, software, and firmware up-to-date.
