Play

Reports per quarter

Techniques seen in the last two years

• T1003 1 report reports only
• T1016 1 report in ATT&CK
• T1027 1 report reports only
• T1048 1 report in ATT&CK
• T1059 1 report reports only
• T1059.001 1 report in ATT&CK
• T1078 1 report in ATT&CK
• T1133 1 report in ATT&CK
• T1190 1 report in ATT&CK
• T1484.001 1 report reports only

Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.

Also listed by ATT&CK

• T1003.001
• T1018
• T1021.002
• T1027.010
• T1030
• T1057
• T1059.003
• T1070.004
• T1078.002
• T1078.003
• T1082
• T1083

CVEs named in reports

• CVE-2018-13379 KEV ransomware
• CVE-2020-12812 KEV ransomware
• CVE-2022-41040 KEV ransomware
• CVE-2022-41082 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   #StopRansomware: Play Ransomware | CISA

   date ORKL added it fromORKL

   Archived copy on ORKL Detailsfor #StopRansomware: Play Ransomware | CISA

2. 21 July 2023

   Ransomware Spotlight: Play

   Malpedia library date fromORKL

   Archived copy on ORKL Detailsfor Ransomware Spotlight: Play

3. 21 December 2022

   https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/malicious-macros-adapt-to-use-microsoft-publisher-to-push-ekipa-rat/

   Malpedia library date Trustwave fromORKLCCS '25 data

   The original link failed its last check. Original publisher Detailsfor https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/malicious-macros-adapt-to-use-microsoft-publisher-to-push-ekipa-rat/

Newest first. Details opens the report in Explore.