Trend Micro Ransomware Spotlight Play July 2023

Play has used Mimikatz and the Windows Task Manager to dump LSASS process memory.

Play has used tools such as AdFind, Nltest, and BloodHound to enumerate shares and hostnames on compromised networks.

Play has used Cobalt Strike to move laterally via SMB.

Play has used Base64-encoded PowerShell scripts for post exploit activities on compromised hosts.

Play has split victims' files into chunks for exfiltration.

Play has used WinSCP to exfiltrate data to actor-controlled accounts.

Play has used the information stealer Grixba to check for a list of security processes.

Play has used Base64-encoded PowerShell scripts to disable Microsoft Defender.

Play has used a batch script to remove indicators of its presence on compromised hosts.

Play has used tools including Wevtutil to remove malicious files from compromised hosts.

Play has used valid domain accounts for access.

Play has used valid local accounts to gain initial access.

Play has leveraged tools to enumerate system information.

Play has used the Grixba information stealer to list security files and processes.

Playcrypt can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.

Play has used Cobalt Strike to download files to compromised machines.

Play has used Remote Desktop Protocol (RDP) and Virtual Private Networks (VPN) for initial access.

Play has exploited known vulnerabilities for initial access including CVE-2018-13379 and CVE-2020-12812 in FortiOS and CVE-2022-41082 and CVE-2022-41040 ("ProxyNotShell") in Microsoft Exchange.

Playcrypt encrypts files on targeted hosts with an AES-RSA hybrid encryption, encrypting every other file portion of 0x100000 bytes.

Playcrypt can use AlphaVSS to delete shadow copies.

Play has used WinRAR to compress files prior to exfiltration.

Play developed and employ Playcrypt ransomware.

Play has used tools including GMER, IOBit, and PowerTool to disable antivirus software.

Play has used tools to remove log files on targeted systems.