The ransomware gang behind several devastating attacks on major American cities has allegedly launched more than 300 successful incidents since June 2022, according to cybersecurity officials in the United States and Australia.
The FBI joined the Cybersecurity and Infrastructure Security Agency and the Australian Cyber Security Centre in publishing an advisory about the Play ransomware gang on Monday.
This year alone, the group left cities like Oakland and Lowell, Massachusetts, as well as Dallas County, scrambling for days to deal with encrypted devices and troves of stolen citizen data.
The government of Switzerland also warned in June that the group had stolen data during an attack on one of its IT providers.
In Australia, the first incident involving the group was observed in April, with the most recent in November.
According to the notice, the group operates with more discretion than some of its competitors.
In most cases, the gang does not include its demands in the ransom note, instead asking victims to contact them through email.
The gang typically exploits stolen account credentials and public-facing applications - targeting vulnerabilities in popular products like the FortiOS vulnerabilities CVE-2018-13379 and CVE-2020-12812, as well as ProxyNotShell vulnerabilities in Microsoft tools.
The hackers use a variety of tools to steal information and to scan for and disable anti-virus software.
Play extension to filenames after splitting compromised data into smaller portions and exfiltrating it to hacker-controlled accounts.
When the Play group first emerged in mid-2022, it targeted government entities in Latin America, according to Trend Micro.
In April, the gang published 600 gigabytes of Oakland government data after releasing an initial batch of 10GB in March.
The leaks included troves of sensitive data stolen from the city's police department, driver's license numbers, Social Security numbers and even information on the city's elected officials.
Jonathan has worked across the globe as a journalist since 2014.
Before moving back to New York City, he worked for news outlets in South Africa, Jordan and Cambodia.
He previously covered cybersecurity at ZDNet and TechRepublic.
This Cyber News was published on therecord.media. Publication date: Mon, 18 Dec 2023 21:40:10 +0000