The FBI and the Cybersecurity and Infrastructure Security Agency on Wednesday warned that the Play ransomware gang has been targeting U.S. critical infrastructure and other organizations using evolving techniques.
The ransomware group was among the most active in 2024 and has targeted a wide range of businesses and infrastructure providers in North America, South America and Europe, the agencies said in a joint advisory. As of May, the group had breached approximately 900 organizations in multiple countries since launching in June 2022, according to the FBI.
Since mid-January, multiple ransomware groups, including initial access brokers affiliated with Play, have targeted vulnerabilities in a remote support tool called SimpleHelp. Researchers disclosed those flaws in January.
The new advisory updates the government’s original December 2023 warning about the Play ransomware group, which is also known as PlayCrypt. The hackers have previously been blamed for attacks targeting ConnectWise ScreenConnect and Rackspace.
The recent attacks exploiting SimpleHelp involve three flaws discovered by security firm Horizon3.ai.
The most notable flaw, CVE-2024-57727, is a path traversal vulnerability that allows an unauthenticated attacker to download arbitrary files from the SimpleHelp server.
“RMM (Remote Monitoring and Management) tools like SimpleHelp have historically been high-value targets for attackers because, if compromised, they enable attackers to easily get initial access into multiple client environments at once,” Naveen Sunkavally, chief architect, Horizon3.ai, told Cybersecurity Dive via email.
SimpleHelp released security updates to address the three vulnerabilities and urged customers to apply the fixes immediately.
CISA added CVE-2024-57727 to its known exploited vulnerabilities catalog in February.
In May, researchers at Sophos disclosed an incident where a threat actor gained access to a managed service provider’s SimpleHelp tool and deployed the DragonForce ransomware, although the researchers do not see any direct ties between DragonForce and Play.
Errol Weiss, chief security officer at the Health Information Sharing and Analysis Center, said only nine of the Play ransomware attacks impacted healthcare and appear to be focused mainly on other sectors.
“That said, I’d encourage all organizations, including those in health, to take the joint advisory seriously and follow the recommendations,” Weiss said.
