THREAT ACTOR
PLAY_
ActivePlay (also tracked as PlayCrypt) is a ransomware operation active since mid-2022, known for double-extortion attacks against state and local governments, healthcare, and education. The group has been linked to Russian-speaking operators and has continued to claim victims at a steady pace through 2024 and 2025.
For Ransomnews editorial coverage of PLAY, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
1,287
Victims tracked
4 / 32
Active mirrors
2022-11-26
First listing
2026-09-21
Most recent
Victims by year
- 2026 204
- 2025 385
- 2024 354
- 2023 305
- 2022 39
Leak site mirrors
32 mirrors tracked, 4 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onionPLAY NEWS snapshot · 2026-05-09 21:10 -
k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onionPLAY NEWS snapshot · 2026-05-09 21:32 -
k7kg3jqzffsxe2z53jjx4goybvxu3a557kpsqakpwi6mrvfgcdo55tid.onionPLAY NEWS snapshot · 2024-12-30 08:12 -
ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onionPLAY NEWS snapshot · 2026-09-23 05:05 -
j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onionPLAY NEWS snapshot · 2026-09-23 05:05 -
zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onionsnapshot · 2024-10-02 22:16 -
37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onionsnapshot · 2024-10-02 22:16 -
eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onionsnapshot · 2024-10-02 22:18 -
slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onionsnapshot · 2024-10-02 22:18 -
x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onion403 Forbidden snapshot · 2026-09-23 05:00 -
eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onionsnapshot · 2024-10-02 22:20 -
jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onionWelcome to nginx! snapshot · 2025-02-25 09:11 -
sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onionWelcome to nginx! snapshot · 2024-11-01 15:00 -
z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onionWelcome to nginx! snapshot · 2024-11-02 13:01 -
kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onionWelcome to nginx! snapshot · 2025-02-25 09:39 -
iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onionWelcome to nginx! snapshot · 2024-11-02 03:01 -
xixkhm6inbg6t5642t2pjafsjsh3eaonpjysdcfvr3zvadlqb6nhryad.onionWelcome to nginx! snapshot · 2025-02-25 08:38 -
giix5r763sbxmu442tmwfb4thqbz4i5ppxcqsmnnlqnm2yiezv6epxqd.onionWelcome to nginx! snapshot · 2025-02-25 08:30 -
mokcrzbitq2gc5qcpxcbce43pawuthyaoazl6iz2xknj53ebyb4r4eid.onionWelcome to nginx! snapshot · 2024-11-02 18:00 -
gpph6awu7hqsmzmr5sihusjoscp3itwtk3b4i2chwspmka2ikuqcwaqd.onion403 Forbidden snapshot · 2025-07-04 09:20 -
v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onionWelcome to nginx! snapshot · 2025-02-25 08:39 -
4xo3cicwo2rhpwr6vkgwt7mqg4oiqihsmoxwlmklf4sjoatkdqjtmcyd.onionWelcome to nginx! snapshot · 2024-11-02 15:03 -
a4gbdvoorwn3tcqijoedvdeukqaqwc6t2kx4gh3gm37gv4p37evvzqad.onionsnapshot · 2024-10-02 23:10 -
6jb5avmh6rvcb7vcux7kaivnzpqcrfg4ui4xv2co5vmspgrwll7lkkyd.onionWelcome to nginx! snapshot · 2025-02-16 14:12 -
doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onionWelcome to nginx! snapshot · 2025-02-16 14:28 -
hbwsxlq3uzknabg2blt7d4mcbu24oriklji36zdqsz3ou3mf2d7bvoid.onionWelcome to nginx! snapshot · 2025-02-16 13:23 -
ysknyr5m5n3pwg4jnaqsytxea2thwsbca3qipi64vlep42flywx7dgqd.onionWelcome to nginx! snapshot · 2025-07-04 09:27 -
b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onion403 Forbidden snapshot · 2026-09-23 05:36 -
p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion403 Forbidden snapshot · 2026-09-23 03:02 -
whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion403 Forbidden snapshot · 2026-08-13 07:17
Recent victims
The 50 most recent victims claimed by PLAY. Total in the index: 1,287.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-21 | Metallco | |
| 2026-09-21 | Hurley | |
| 2026-09-18 | Vista Plastic Solutions | |
| 2026-09-18 | Inglewood Golf | |
| 2026-09-18 | Barrett Mahony Consulting Engineers | |
| 2026-09-10 | Sys-kool | |
| 2026-09-10 | Grunthal Welding & Supplies | |
| 2026-09-09 | Red Star Oil | |
| 2026-09-09 | GT Distributors | |
| 2026-08-31 | MEQ | |
| 2026-08-31 | Figgins Family Wine Estates | |
| 2026-08-31 | KRC Machine Tool Solutions | |
| 2026-08-31 | Meteor Group | |
| 2026-08-20 | Be Media | |
| 2026-08-20 | Latoplast | |
| 2026-08-18 | Coltrane Systems | |
| 2026-08-17 | Bridgeport Capital Services | |
| 2026-08-17 | Sam Pack Auto Group | |
| 2026-08-17 | Woodhaven Association | |
| 2026-08-09 | MIE Solutions | |
| 2026-08-09 | Rilpa Enterprises | |
| 2026-08-09 | Marconi Industrial Services | |
| 2026-08-06 | Signature Services | |
| 2026-08-06 | GCATS Investments | |
| 2026-08-06 | Platinum Group | |
| 2026-08-05 | First Tek | |
| 2026-08-05 | Preferred Financial Group | |
| 2026-08-02 | The Butcher Brothers | |
| 2026-08-02 | Sigma Plastics Group | |
| 2026-08-02 | Cambridge Management | |
| 2026-07-23 | Record Go Alquiler | |
| 2026-07-23 | Restaurant Depot | |
| 2026-07-23 | The DeBruler | |
| 2026-07-22 | Tax MT | |
| 2026-07-22 | Kreysler & Associates | |
| 2026-07-16 | Boston Electric and Telephone | |
| 2026-07-16 | Wring Group | |
| 2026-07-16 | AG Scholtes | |
| 2026-07-16 | Andorra Life | |
| 2026-07-16 | Svensk Direktreklam | |
| 2026-07-07 | Preneed Funeral Programs | |
| 2026-07-07 | Kevin Bao Lenguyen | |
| 2026-07-07 | United Infrastructure | |
| 2026-07-04 | Locati Architects | |
| 2026-07-04 | Silvestri & Associates Insurance | |
| 2026-06-30 | Western Construction | |
| 2026-06-27 | J&J Gaming | |
| 2026-06-27 | Kuhnline | |
| 2026-06-26 | Benchmark Industrial Supply | |
| 2026-06-17 | Greg Crosslin |
CONFIRMED ATTACKS
Play confirmed attacks: 223 verified incidents
Ransomnews has verified 223 Play incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from August 2022 to August 2026. United States accounts for 169 of them (76%), with victims recorded in 25 countries in total. The most affected sector is manufacturing, at 45 confirmed victims. A ransom payment was publicly confirmed in 1 case and publicly refused in 22; the outcome is unrecorded in the remaining 200. Where a figure was disclosed (123 cases), these incidents account for 1,645,948 exposed records.
223Verified incidents
25Countries
2022–2026Active range
4%Paid, where outcome known
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Play incidents (100 most recent of 223)
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2026 | Woodhaven Lakes | Other | Illinois, United States | — | Unknown | Source |
| July 2026 | Svensk Direktreklam (SDR) | Service | Uppsala, Sweden | — | No | Source |
| March 2026 | Block Engineering | Manufacturing | Massachusetts, United States | 109 | Unknown | Source |
| March 2026 | T.A. Solberg Co., Inc. | Other | Wisconsin, United States | — | Unknown | Source |
| March 2026 | Circle Floors, Inc. | Service | Massachusetts, United States | 18 | Unknown | Source |
| March 2026 | Ampex Data Systems Corp. | Manufacturing | California, United States | 3,723 | Unknown | Source |
| March 2026 | Cabka N.V. | Manufacturing | Amsterdam, Netherlands | — | Unknown | Source |
| February 2026 | Project Consulting Services | Service | Louisiana, United States | 1,572 | Unknown | Source |
| February 2026 | Lusamerica Foods Inc. | Food and Beverage | California, United States | — | Unknown | Source |
| February 2026 | Auto Auction of New England Inc. | Retail | New Hampshire, United States | 91 | Unknown | Source |
| February 2026 | De Gruyter Brill Inc. | Other | Massachusetts, United States | 263 | Unknown | Source |
| January 2026 | Bloom's Bus Lines, Inc. | Transportation | Massachusetts, United States | 1,413 | Unknown | Source |
| January 2026 | Eastern Ice | Food and Beverage | Massachusetts, United States | 301 | Unknown | Source |
| December 2025 | Kucera International, Inc. | Service | Ohio, United States | 268 | Unknown | Source |
| December 2025 | Mill Brothers Landscape Group | Service | Colorado, United States | — | Unknown | Source |
| December 2025 | Rockport Technology Group, Inc. | Technology | New Hampshire, United States | 91 | Unknown | Source |
| December 2025 | Ford Autohaus Pichel GmbH | Retail | Hartmannsdorf, Germany | — | Unknown | Source |
| November 2025 | RSVP (Sellers Publishing, Inc.) | Retail | Maine, United States | 262 | Unknown | Source |
| October 2025 | Hy LaBonne & Sons, Inc. (LaBonne's Markets) | Food and Beverage | Connecticut, United States | 3,434 | Unknown | Source |
| October 2025 | BMP America Inc. | Manufacturing | New York, United States | 440 | Unknown | Source |
| October 2025 | Legacy Manufacturing Company | Manufacturing | Iowa, United States | — | Unknown | Source |
| October 2025 | Fast Freight | Transportation | Coquitlam, Canada | — | Unknown | Source |
| September 2025 | Pathfinder/LL&D Insurance Group | Finance | Texas, United States | 7,804 | Unknown | Source |
| September 2025 | Komar Industries, LLC | Manufacturing | Ohio, United States | 1,078 | Unknown | Source |
| September 2025 | Waterborne Environmental, Inc. | Service | Virginia, United States | 423 | Unknown | Source |
| September 2025 | TerranearPMC | Service | Pennsylvania, United States | — | Unknown | Source |
| September 2025 | Thomas Safran & Associates | Construction | California, United States | — | Unknown | Source |
| September 2025 | Takeuchi Mfg. (U.S.) Ltd | Manufacturing | Georgia, United States | 880 | Unknown | Source |
| August 2025 | Hilldun Corporation | Finance | New York, United States | — | Unknown | Source |
| August 2025 | Cool Wind Ventilation Corp. | Manufacturing | New York, United States | 1,404 | Unknown | Source |
| August 2025 | GL Veneer, Inc. | Manufacturing | California, United States | — | Unknown | Source |
| August 2025 | All States Materials Group | Manufacturing | Massachusetts, United States | 3,268 | Unknown | Source |
| July 2025 | Rockrose Development L.L.C. | Construction | New York, United States | 47,392 | Unknown | Source |
| July 2025 | Terillium | Technology | Ohio, United States | 631 | Unknown | Source |
| July 2025 | Refrigeration-Heating, Inc. dba RHI Supply, Inc. | Retail | North Dakota, United States | — | Unknown | Source |
| July 2025 | Phoenix Products, LLC (Phoenix Lighting) | Manufacturing | Wisconsin, United States | 416 | Unknown | Source |
| July 2025 | Hulberg & Associates, Inc. | Service | California, United States | — | Unknown | Source |
| June 2025 | Community Grants, Planning & Housing, LLC (CGP&H, LLC) | Other | New Jersey, United States | — | Unknown | Source |
| June 2025 | Vacation Myrtle Beach | Other | South Carolina, United States | 10,750 | Unknown | Source |
| June 2025 | Lydig Construction, Inc. | Construction | Washington, United States | — | Unknown | Source |
| June 2025 | Tyree Oil, Inc. | Other | Oregon, United States | 4,821 | Unknown | Source |
| June 2025 | Ojo Caliente Holdings, Inc. (Ojo Spa Resorts) | Other | New Mexico, United States | 2,163 | Unknown | Source |
| June 2025 | All Choice Rentals Ltd. | Service | Drayton Valley, Canada | — | Unknown | Source |
| June 2025 | Merlin Industries, Inc. | Manufacturing | New Jersey, United States | — | Unknown | Source |
| June 2025 | Dairy Farmers of America, Inc. | Food and Beverage | Kansas, United States | 4,546 | Unknown | Source |
| May 2025 | Homestead Gardens Inc. | Retail | Maryland, United States | — | Unknown | Source |
| May 2025 | EIZO Rugged Solutions, Inc. | Manufacturing | Florida, United States | — | Unknown | Source |
| May 2025 | Carney Badley Spellman, PS | Legal | Washington, United States | — | Unknown | Source |
| May 2025 | Community Choice Credit Union | Finance | Colorado, United States | 8,465 | Unknown | Source |
| May 2025 | Verrex | Technology | New Jersey, United States | — | Unknown | Source |
| May 2025 | Anchor Industries, Inc. | Manufacturing | Indiana, United States | 1,949 | Unknown | Source |
| May 2025 | Media Links, Inc. | Technology | Connecticut, United States | — | Unknown | Source |
| April 2025 | Lantronix Inc. | Technology | California, United States | — | Unknown | Source |
| April 2025 | CNHI, LLC | Other | Alabama, United States | 20,300 | Unknown | Source |
| April 2025 | NESCTC Security Agency, LLC | Service | Rhode Island, United States | — | Unknown | Source |
| April 2025 | AttainX, Inc. | Technology | Virginia, United States | 746 | Unknown | Source |
| April 2025 | O'Brien & Ryan, LLP | Legal | Pennsylvania, United States | 584 | Unknown | Source |
| April 2025 | Gorham Sand & Gravel, Inc. | Construction | Maine, United States | 666 | Unknown | Source |
| April 2025 | The Seydel Companies, Inc. | Manufacturing | Georgia, United States | 340 | Unknown | Source |
| March 2025 | Fraser Trebilcock Davis Dunlap & Cavanaugh, P.C. | Legal | Michigan, United States | — | Unknown | Source |
| March 2025 | OTA Management LLC | Finance | New York, United States | 913 | Unknown | Source |
| March 2025 | PAC Strapping Products, Inc. | Manufacturing | Pennsylvania, United States | 647 | Unknown | Source |
| March 2025 | Regionale Verkehrsbetriebe Baden-Wettingen AG | Government | Wettingen, Switzerland | — | No | Source |
| March 2025 | SYMA-SYSTEM AG | Service | Kirchberg, Switzerland | — | Unknown | Source |
| February 2025 | Alcott HR | Service | New York, United States | 76,098 | Unknown | Source |
| February 2025 | EAC Consulting, Inc. | Service | Florida, United States | — | Unknown | Source |
| February 2025 | Oxford Companies | Service | Michigan, United States | 559 | Unknown | Source |
| February 2025 | Clawson Honda of Fresno | Retail | California, United States | — | Unknown | Source |
| February 2025 | First Federal Savings & Loan Association of Pascagoula Moss Point | Finance | Mississippi, United States | 2,361 | Unknown | Source |
| February 2025 | Compound Solutions, Inc. | Manufacturing | California, United States | 375 | Unknown | Source |
| February 2025 | Baltimore Country Club | Other | Maryland, United States | 4,214 | Unknown | Source |
| February 2025 | Jildor Shoes, Inc. | Retail | New York, United States | — | No | Source |
| February 2025 | Rock Solid Stabilization & Reclamation, Inc. | Construction | Wisconsin, United States | 1,018 | Unknown | Source |
| February 2025 | Ganong Bros., Limited. | Food and Beverage | St. Stephen, Canada | — | Unknown | Source |
| January 2025 | Shields Facilities Maintenance, LLC | Service | Pennsylvania, United States | 1,314 | Unknown | Source |
| January 2025 | KWS Manufacturing Company | Manufacturing | Texas, United States | 1,466 | Unknown | Source |
| January 2025 | Mid-State Industrial Maintenance | Manufacturing | Florida, United States | 7,127 | Unknown | Source |
| December 2024 | NatAlliance Securities, LLC | Finance | Texas, United States | — | Unknown | Source |
| December 2024 | Lanigan Ryan | Finance | Maryland, United States | 31,340 | Unknown | Source |
| December 2024 | Long Beach Convention and Entertainment Center | Other | California, United States | 5,827 | Unknown | Source |
| December 2024 | Standard Calibrations, Inc. (SCI) | Service | Virginia, United States | 537 | Unknown | Source |
| December 2024 | ITO EN (North America) INC. | Food and Beverage | New York, United States | — | Unknown | Source |
| November 2024 | Max Trans, LLC | Transportation | Tennessee, United States | 2,200 | Unknown | Source |
| November 2024 | LenelS2 | Technology | Massachusetts, United States | 548 | Unknown | Source |
| November 2024 | Krispy Kreme | Food and Beverage | North Carolina, United States | 161,676 | Unknown | Source |
| October 2024 | Mainelli Mechanical Contractors, Inc. | Construction | Nebraska, United States | — | Unknown | Source |
| October 2024 | Birdair, Inc. | Construction | New York, United States | 3,173 | Unknown | Source |
| October 2024 | TV Guide Magazine LLC | Other | New York, United States | 1,153 | Unknown | Source |
| October 2024 | Arctic Slope Telephone Association Cooperative (ASTAC) | Utilities | Alaska, United States | — | Unknown | Source |
| October 2024 | Joy Rockwell Ent., Inc dba PostcardMania | Service | Florida, United States | 2,640 | Unknown | Source |
| October 2024 | Dome Construction | Construction | California, United States | — | Unknown | Source |
| October 2024 | IVC Technologies | Technology | Ohio, United States | 419 | Unknown | Source |
| October 2024 | Paul White Company | Service | Maine, United States | 1,102 | No | Source |
| October 2024 | J.S. McCarthy Co., Inc. | Service | Maine, United States | 618 | Unknown | Source |
| October 2024 | OzarksGo | Utilities | Arkansas, United States | — | Unknown | Source |
| September 2024 | Baskervill & Son, P.C. | Service | Virginia, United States | 728 | Unknown | Source |
| September 2024 | Plaisted Companies Inc. | Retail | Minnesota, United States | — | Unknown | Source |
| September 2024 | Harbinger Group, LLC d/b/a Misionero Vegetables | Food and Beverage | California, United States | — | Unknown | Source |
| September 2024 | Mile Hi Companies (Mile Hi Foods) | Transportation | Colorado, United States | 6,210 | Unknown | Source |
| September 2024 | Bel-Air Bay Club Ltd. | Other | California, United States | 1,834 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Play's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.