Procedure examples

Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.

Play has used the information-stealing tool Grixba to enumerate network information.

Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.

Play has used Cobalt Strike to move laterally via SMB.

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

Play has split victims' files into chunks for exfiltration.

Play has used WinSCP to exfiltrate data to actor-controlled accounts.

Play has used the information stealer Grixba to check for a list of security processes.

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

Play has used a batch script to remove indicators of its presence on compromised hosts.

Play has used tools including Wevtutil to remove malicious files from compromised hosts.

Play has used valid VPN accounts to achieve initial access.

Play has used valid domain accounts for access.

Play has used valid local accounts to gain initial access.

Play has leveraged tools to enumerate system information.

Play has used the Grixba information stealer to list security files and processes.

Play has used Cobalt Strike to download files to compromised machines.

Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.

Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.

Play has used the information-stealing tool Grixba to scan for anti-virus software.

Play has used WinRAR to compress files prior to exfiltration.

Play developed and employ Playcrypt ransomware.

Play has used multiple tools for discovery and defense evasion purposes on compromised hosts.

Play demands ransom payments from victims to unencrypt filesystems and to not publish sensitive data exfiltrated from victim networks.

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

Play has used tools to remove log files on targeted systems.