Play
aka Playcrypt
A ransomware group active since 2022 that gets in through Fortinet VPN, Exchange and remote-support tool flaws, hitting businesses and critical infrastructure across the Americas and Europe.
- Alert level
- 4/ 5
- Reports & advisories (90 days)
- 4
- Known exploited CVEs
- 5
- Personal data leaked (disclosed)
- None confirmed
Exploited vulnerabilities and targeted products
CVE-2018-13379 CVE-2020-12812 CVE-2022-41040 CVE-2022-41082 CVE-2024-57727
If you run any of these products, first make sure they are updated to a fixed version.
How they attack
Entry
Exploiting internet-facing devices
Like finding a broken lock on the company's front gate (VPN or firewall) and walking in.
Inside
Staying in with remote-support tools
Like cutting yourself a copy of the repair company's key so you can come and go anytime.
Goal
Encrypting whole virtualization hosts
Like seizing the building's power room to shut every floor at once instead of going room by room.
Goal
Double extortion: encrypt and leak
Like locking your safe and also taking copies of the papers inside, threatening to publish them unless you pay.
Recent articles
- Slack Morphism verifier errors disclose valid HMACs in the logs
- Migrating Pinkary from Laravel Forge to Laravel Cloud: An engineering playbook
- 8.12-m01-int: Add aof_cmd_duration estimate for AOF reload RTO visibility
- cve-2026-41707 - HIGH - Spring Security DPoPProofJwtDecoderFactory vulnerable to DPoP Proof Replay
- Swift at Apple: Migrating the TrueType Hinting Interpreter
- From Kubernetes Dashboard to Headlamp: Understanding the Transition
- Build a dinosaur runner game with Deno, pt. 5
- Ambitious Projects Are the Framework for Success. The Artisan of the Day Is Will King.
Sources
Attributions are quoted as assessed by governments and security vendors. VulnPulse does not make attributions itself.
Leak counts only add up figures disclosed by the affected companies or authorities, never the attackers' own claims. We do not list victim names or link to leak sites.
The alert level is calculated automatically from reports and advisories in the last 90 days, known exploited vulnerabilities, and whether the group has targeted Japan.
Updated 2026-10-23 · daily