PLAY Ransomware Campaign: US & Spain Hospitality/Retail Hit — Detection Rules for ScreenConnect & Check Point Exploits

Aliases: Play, Crypt (historical association)

Operational Model: PLAY operates as a closed-group Ransomware-as-a-Service (RaaS) entity with a highly disciplined affiliate network. Unlike commodity groups, they maintain strict operational security (OpSec) and utilize custom-developed ransomware written in Go and C++.

Ransom Demands: Demands vary significantly but typically range from $500,000 to several million USD, primarily based on victim revenue and the sensitivity of exfiltrated data.

Initial Access Vectors: PLAY affiliates aggressively exploit public-facing applications (VPNs, Firewalls) and remote management tools. Based on current intelligence, they are actively leveraging:

• Remote Access: Exploitation of ConnectWise ScreenConnect (CVE-2024-1708) and Check Point Security Gateway (CVE-2026-50751).
• Valid Credentials: Phishing campaigns leading to credential theft for VPN/RDP brute-forcing.

Tactics & Dwell Time: PLAY is notorious for "speed encryption." The average dwell time (time from initial access to encryption) is extremely short—often less than 72 hours and sometimes under 24 hours. They prioritize manual lateral movement over automated spreading to evade EDR detection.

Extortion Strategy: Strict double extortion. They exfiltrate large volumes of data (tens/hundreds of GBs) and threaten to leak it if the ransom is not paid. They have been observed engaging in DDoS attacks to pressure victims during negotiations.

Current Campaign Analysis

Campaign Date: 2026-07-24

Targeted Sectors:

• Hospitality: (Record Go Alquiler)
• Retail & E-Commerce: (Restaurant Depot)
• Professional Services: (Kreysler & Associates)

Geographic Concentration:

• Spain (ES): 1 Victim
• United States (US): 2 Victims

Victim Profile: The current campaign targets mid-to-large market enterprises.

• Record Go Alquiler: High-volume mobility/rental sector (likely high transaction volume data).
• Restaurant Depot: Major food supply chain retailer (high value PII and financial data).
• Kreysler & Associates: Specialized engineering/architecture (valuable IP and client blueprints).

Observed Posting Frequency: PLAY has posted 3 victims in the last 100 postings, but the recent activity cluster (3 posts within 48 hours between July 21-23) suggests a surge in successful exploits, specifically tied to the CISA KEV listed vulnerabilities.

CVE Correlation (Initial Access Vectors): Based on the victimology and timing, we assess with high confidence that PLAY is actively exploiting the following CVEs for initial access:

1. CVE-2024-1708 (ConnectWise ScreenConnect): A critical path traversal vulnerability allowing RCE. This is a primary vector for the Retail and Professional Services targets utilizing managed service providers (MSPs) or internal remote support.
2. CVE-2026-50751 (Check Point Security Gateway): An improper authentication vulnerability in IKEv1. This is likely the vector for the cross-border targeting, potentially used against Record Go Alquiler to bypass perimeter defenses.

Detection Engineering

Sigma Rules

---
title: Potential ScreenConnect Authentication Bypass (CVE-2024-1708)
id: 5a1b0c9d-4e3f-5a6b-7c8d-9e0f1a2b3c4d
description: Detects potential exploitation of ConnectWise ScreenConnect path traversal vulnerability via suspicious URI patterns or web session anomalies.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    category: webserver
detection:
    selection:
        cs-uri-query|contains:
            - '/Handlers/Authentication.ashx'
            - '/Services/ServerService.ashx'
    filter_legit:
        cs-method|notcontains: 'GET' # Exploits often use unusual verbs or POST on endpoints expecting GET
    condition: selection and not filter_legit
falsepositives:
    - Legitimate administrative access
level: critical
tags:
    - cve.2024.1708
    - initial_access
    - ransomware.play
---
title: Check Point Security Gateway IKEv1 Anomaly (CVE-2026-50751)
id: 6b2c1d0e-5f4a-6b7c-8d9e-0f1a2b3c4d5e
description: Detects potential exploitation of Check Point IKEv1 improper authentication vulnerability indicated by abnormal VPN log patterns or repeated key exchange failures followed by success.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
references:
    - https://www.cisa.gov/known-exploited-vulnerabilities-catalog
logsource:
    product: firewall
    service: vpn
detection:
    selection_ikev1:
        protocol|contains: 'IKE'
        version: 'v1'
    selection_failure:
        action: 'deny' or 'drop'
    selection_success:
        action: 'accept'
        src_ip|contains: 'External'
    timeframe: 1m
    condition: selection_ikev1 and selection_failure | until | selection_success
falsepositives:
    - Misconfigured VPN clients
    - Network instability
level: high
tags:
    - cve.2026.50751
    - initial_access
    - emet
    - play
---
title: Rclone Cloud Storage Exfiltration Tool
id: 7c3d2e1f-0g5h-6i7j-8k9l-0m1n2o3p4q5r
description: Detects the use of rclone, a tool frequently used by PLAY ransomware for data exfiltration to cloud storage.
status: experimental
date: 2026/07/24
author: Security Arsenal Research
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:
            - '\rclone.exe'
            - '\rc.exe'
    selection_cli:
        CommandLine|contains:
            - 'config create'
            - 'copy'
            - 'sync'
            - 'megacmd' # Associated cloud storage
            - 'pcloud'
    condition: 1 of selection_*
falsepositives:
    - Legitimate admin backup tasks
level: critical
tags:
    - attack.exfiltration
    - attack.t1567.002
    - playbook.play

KQL (Microsoft Sentinel)

Hunt for lateral movement indicators and data staging commonly associated with PLAY. This query looks for the execution of 7-Zip and Rclone (common staging/exfil tools) spawned from unusual parent processes or command lines.

DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ('rclone.exe', '7z.exe', 'winrar.exe', 'powershell.exe')
| extend ProcessCommandLine = ProcessCommandLine // Normalize
| where ProcessCommandLine contains any('-p', '-mhe', 'sync', 'copy', 'config', 'Encrypted', 'webclient', 'DownloadString')
| where InitiatingProcessFileName !in~ ('explorer.exe', 'cmd.exe', 'services.exe', 'svchost.exe')
   or (InitiatingProcessFileName == 'powershell.exe' and ProcessCommandLine contains 'Hidden')
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, FolderPath
| order by Timestamp desc

PowerShell Rapid Response Script

This script checks for key indicators of PLAY ransomware activity: enumeration of recent tasks, rclone presence, and Volume Shadow Copy manipulation.

# PLAY Ransomware Rapid Response Check
Write-Host "[+] Checking for PLAY Indicators of Compromise..." -ForegroundColor Cyan

# 1. Check for Rclone (Exfil Tool)
$RclonePath = Get-ChildItem -Path "C:\" -Recurse -ErrorAction SilentlyContinue -Filter "rclone.exe" | Select-Object -First 1 FullName
if ($RclonePath) {
    Write-Host "[!] ALERT: Rclone found at $($RclonePath.FullName)" -ForegroundColor Red
} else {
    Write-Host "[-] No Rclone found." -ForegroundColor Green
}

# 2. Check for Scheduled Tasks created in last 24h (Persistence)
$RecentTasks = Get-ScheduledTask | Where-Object { $_.Date -gt (Get-Date).AddHours(-24) }
if ($RecentTasks) {
    Write-Host "[!] ALERT: Recent Scheduled Tasks found (Last 24h):" -ForegroundColor Yellow
    $RecentTasks | Format-List TaskName, Date, Author
} else {
    Write-Host "[-] No suspicious recent scheduled tasks." -ForegroundColor Green
}

# 3. Check for Shadow Copy Deletion Attempts (Vssadmin)
$VssEvents = Get-WinEvent -FilterHashtable @{LogName='Security'; Id=4688; StartTime=(Get-Date).AddHours(-48)} -ErrorAction SilentlyContinue |
              Where-Object { $_.Message -match 'vssadmin' -and $_.Message -match 'delete shadows' }
if ($VssEvents) {
    Write-Host "[!] ALERT: Shadow Copy deletion commands detected in Event Logs." -ForegroundColor Red
} else {
    Write-Host "[-] No Shadow Copy deletion events found." -ForegroundColor Green
}

Write-Host "[+] Scan Complete." -ForegroundColor Cyan


---

Incident Response Priorities

T-Minus Detection Checklist (Pre-Encryption):

1. Rclone Traffic: Look for outbound connections to known cloud storage endpoints (Google Drive, Dropbox, Mega, pCloud) from server segments where this activity is not business-standard.
2. ScreenConnect Logs: Audit ConnectWise ScreenConnect logs for WebService.asmx anomalies or logins from unusual geo-locations (CIS region).
3. Process Anomalies: Monitor for powershell.exe spawning with -Enc or hidden window styles immediately following a VPN authentication event.

Critical Assets for Exfiltration: PLAY targets high-value data to maximize leverage:

• Hospitality: Customer PII, passport scans, payment card data.
• Retail: Supply chain manifests, customer loyalty databases, financial ledger.
• Professional Services: Intellectual property, CAD drawings, client legal documents.

Containment Actions (Order of Urgency):

1. Isolate: Disconnect the VPN concentrator (Check Point/Firewall) from the internal network if under active attack.
2. Disable: Immediately shut down the ScreenConnect server service.
3. Block: Firewall outbound rules for all non-essential cloud storage IPs (except those explicitly whitelisted for business).
4. Reset: Force reset of all local administrator passwords and service account credentials, especially for accounts with VPN access.

Hardening Recommendations

Immediate (24 Hours):

• Patch CVE-2024-1708: Apply the ScreenConnect hotfix immediately. If patching is delayed, block internet access to the ScreenConnect web interface at the firewall level and enforce MFA on all internal access.
• Patch CVE-2026-50751: Update Check Point Security Gateways to the latest version where IKEv1 authentication is patched or disable IKEv1 if not required.
• Audit VPN Access: Remove all orphaned VPN accounts and enforce strict geo-blocking for non-traveling employees.

Short-Term (2 Weeks):

• Network Segmentation: Ensure the Guest Wi-Fi and OT/IoT networks are strictly segmented from the corporate backbone to prevent lateral movement from perimeter exploits.
• EDR Coverage: Ensure EDR agents are deployed and reporting on all perimeter management servers (VPN gateways, ScreenConnect servers) and Domain Controllers.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub