A ransomware gang named “Play” was discovered on the Dark Web. Along with them, a list of 22 victims has been revealed. There is a piece of evidence that points to a possible connection between Play ransomware and Quantum ransomware, which is an offshoot of the notorious Conti ransomware group. The Cobalt Strike beacons that were used in Play’s attacks bear the same watermark, 206546002, as those previously dropped by Emotet and SVCReady botnets that have also been observed in Quantum ransomware attacks. This suggests that the two ransomware groups share some of the same infrastructure. Play Ransomware specifically targets backup solutions in order to ensure that the victim has no other option to recover the data. Play group is particularly methodical in developing and implementing backup removal techniques. Here’s a blog post on the infection routine and backup environment attack method.
