// THREAT ACTOR
PLAY_
ActivePlay (also tracked as PlayCrypt) is a ransomware operation active since mid-2022, known for double-extortion attacks against state and local governments, healthcare, and education. The group has been linked to Russian-speaking operators and has continued to claim victims at a steady pace through 2024 and 2025.
For Ransomnews editorial coverage of PLAY — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
1,265
Victims tracked
5 / 32
Active mirrors
2022-11-26
First listing
2026-08-06
Most recent
Victims by year
- 2026 182
- 2025 385
- 2024 354
- 2023 305
- 2022 39
Leak site mirrors
32 mirrors tracked, 5 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
mbrlkbtq5jonaqkurjwmxftytyn2ethqvbxfu4rgjbkkknndqwae6byd.onionPLAY NEWS snapshot · 2026-05-09 21:10 -
k7kg3jqxang3wh7hnmaiokchk7qoebupfgoik6rha6mjpzwupwtj25yd.onionPLAY NEWS snapshot · 2026-05-09 21:32 -
k7kg3jqzffsxe2z53jjx4goybvxu3a557kpsqakpwi6mrvfgcdo55tid.onionPLAY NEWS snapshot · 2024-12-30 08:12 -
ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onionPLAY NEWS snapshot · 2026-08-06 18:03 -
j75o7xvvsm4lpsjhkjvb4wl2q6ajegvabe6oswthuaubbykk4xkzgpid.onionPLAY NEWS snapshot · 2026-08-06 21:31 -
zi34ocznt242jallttwvvhihrezjdzfgflf3uhdv6t3z23hhcn54efid.onionsnapshot · 2024-10-02 22:16 -
37wb3ygyb3r2vf2dt5o3ca62zlduuowvkkwjrtbcgc5iri4t6rnzr7yd.onionsnapshot · 2024-10-02 22:16 -
eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onionsnapshot · 2024-10-02 22:18 -
slg7tnjb65swwyaebnyymyvo73xm36hxwugdsps7cwcxicizyzyt2byd.onionsnapshot · 2024-10-02 22:18 -
x6zdxw6vt3gtpv35yqloydttvfvwyrju3opkmp4xejmlfxto7ahgnpyd.onionIndex of / snapshot · 2026-08-06 21:39 -
eppsldmcnv3ylabsx5srvf36wnk6jrowg6x4unxclv55rnu4kf5436yd.onionsnapshot · 2024-10-02 22:20 -
jnbiz5lp44ddg4u5rsr4yebbpxa3iytcsshgbqa4m6r6po5y57h6yxid.onionWelcome to nginx! snapshot · 2025-02-25 09:11 -
sm2gah7bjg6u2dfl3voiex6njh2kcuqqquvv7za37xokmbcivsgqcnad.onionWelcome to nginx! snapshot · 2024-11-01 15:00 -
z7u6dkys7b2aeibvklxga7mldzrepoauiuniqwfhdadkkwwgmv6bqhad.onionWelcome to nginx! snapshot · 2024-11-02 13:01 -
kri3lez34pbqra3xs5wxo55djldtsekol6tuqdjqecqzga6dpnjqruyd.onionWelcome to nginx! snapshot · 2025-02-25 09:39 -
iejj6bywviuecjwi3kxanzojqroe3j3phzgplvrdzcicimtcw6xgk3yd.onionWelcome to nginx! snapshot · 2024-11-02 03:01 -
xixkhm6inbg6t5642t2pjafsjsh3eaonpjysdcfvr3zvadlqb6nhryad.onionWelcome to nginx! snapshot · 2025-02-25 08:38 -
giix5r763sbxmu442tmwfb4thqbz4i5ppxcqsmnnlqnm2yiezv6epxqd.onionWelcome to nginx! snapshot · 2025-02-25 08:30 -
mokcrzbitq2gc5qcpxcbce43pawuthyaoazl6iz2xknj53ebyb4r4eid.onionWelcome to nginx! snapshot · 2024-11-02 18:00 -
gpph6awu7hqsmzmr5sihusjoscp3itwtk3b4i2chwspmka2ikuqcwaqd.onion403 Forbidden snapshot · 2025-07-04 09:20 -
v3r6g4q3b2jpqusznecxexr5aqi42vy5ts6jy6fu3strecvb5c2woead.onionWelcome to nginx! snapshot · 2025-02-25 08:39 -
4xo3cicwo2rhpwr6vkgwt7mqg4oiqihsmoxwlmklf4sjoatkdqjtmcyd.onionWelcome to nginx! snapshot · 2024-11-02 15:03 -
a4gbdvoorwn3tcqijoedvdeukqaqwc6t2kx4gh3gm37gv4p37evvzqad.onionsnapshot · 2024-10-02 23:10 -
6jb5avmh6rvcb7vcux7kaivnzpqcrfg4ui4xv2co5vmspgrwll7lkkyd.onionWelcome to nginx! snapshot · 2025-02-16 14:12 -
doz7omlqqanryonvil4iuj65shzcv3efupqwubkza6553wnekrrd4uid.onionWelcome to nginx! snapshot · 2025-02-16 14:28 -
hbwsxlq3uzknabg2blt7d4mcbu24oriklji36zdqsz3ou3mf2d7bvoid.onionWelcome to nginx! snapshot · 2025-02-16 13:23 -
ysknyr5m5n3pwg4jnaqsytxea2thwsbca3qipi64vlep42flywx7dgqd.onionWelcome to nginx! snapshot · 2025-07-04 09:27 -
b3pzp6qwelgeygmzn6awkduym6s4gxh6htwxuxeydrziwzlx63zergyd.onionIndex of / snapshot · 2026-08-06 21:25 -
p2qzf3rfvg4f74v2ambcnr6vniueucitbw6lyupkagsqejtuyak6qrid.onion403 Forbidden snapshot · 2026-08-06 21:14 -
whfsjr35whjtrmmqqeqfxscfq564htdm427mjekic63737xscuayvkad.onion403 Forbidden snapshot · 2026-08-06 21:25
Recent victims
The 50 most recent victims claimed by PLAY. Total in the index: 1,265.
| Date listed | Victim | Description |
|---|---|---|
| 2026-08-06 | Signature Services | |
| 2026-08-06 | GCATS Investments | |
| 2026-08-06 | Platinum Group | |
| 2026-08-05 | First Tek | |
| 2026-08-05 | Preferred Financial Group | |
| 2026-08-02 | The Butcher Brothers | |
| 2026-08-02 | Sigma Plastics Group | |
| 2026-08-02 | Cambridge Management | |
| 2026-07-23 | Record Go Alquiler | |
| 2026-07-23 | Restaurant Depot | |
| 2026-07-23 | The DeBruler | |
| 2026-07-22 | Tax MT | |
| 2026-07-22 | Kreysler & Associates | |
| 2026-07-16 | Boston Electric and Telephone | |
| 2026-07-16 | Wring Group | |
| 2026-07-16 | AG Scholtes | |
| 2026-07-16 | Andorra Life | |
| 2026-07-16 | Svensk Direktreklam | |
| 2026-07-07 | Preneed Funeral Programs | |
| 2026-07-07 | Kevin Bao Lenguyen | |
| 2026-07-07 | United Infrastructure | |
| 2026-07-04 | Locati Architects | |
| 2026-07-04 | Silvestri & Associates Insurance | |
| 2026-06-30 | Western Construction | |
| 2026-06-27 | J&J Gaming | |
| 2026-06-27 | Kuhnline | |
| 2026-06-26 | Benchmark Industrial Supply | |
| 2026-06-17 | Greg Crosslin | |
| 2026-06-17 | Integrated Technologies | |
| 2026-06-17 | eurOptimum | |
| 2026-06-10 | Mundt and Associates | |
| 2026-06-10 | Rainbow Distributors USA | |
| 2026-06-06 | Pearson Ford | |
| 2026-06-05 | Urschel Laboratories | |
| 2026-06-05 | Dallis Law Firm | |
| 2026-06-05 | The Chapel | |
| 2026-06-05 | Corley MFG | |
| 2026-06-01 | Digitall Graphics | |
| 2026-06-01 | Hightower Communications | |
| 2026-05-25 | GW Mechanical | |
| 2026-05-25 | NL Fisher | |
| 2026-05-25 | Round Hill Country Club | |
| 2026-05-25 | Legend Networking & Telecom | |
| 2026-05-25 | MyPillow | |
| 2026-05-25 | De Waard Transport | |
| 2026-05-19 | Zuther Hautmann | |
| 2026-05-12 | Infoworld Membership Systems | |
| 2026-05-12 | Town Car International | |
| 2026-05-12 | Northern Mechanical Contractors | |
| 2026-05-12 | ACC Construction |