CommunityReports: CR-016-PLAY-APR-2025.md
Recurso del BushidoUK Ransomware Tool Matrix - CommunityReports.
Community Report 016 - PLAY April 2025
Contributor Details
- Real Name: N/A
- Online Handle / Links to profiles: https://x.com/SecurityAura
- Employer: Private, DFIR role
- Affiliations: Curated Intelligence
---
Adversary
- Named adversary: PLAY
---
Incident Details
- Time of Incident: April 2025
- Victim Sector: Retail
- Victim Country: Canada
- Victim Size: 50-200
---
Observed Tools
| Discovery | RMM Tools | Defense Evasion | Credential Theft | OffSec | Networking | LOLBAS | Exfiltration |
|---|---|---|---|---|---|---|---|
| | | icardagt.exe | Mimikatz | | Fast Reverse Proxy Client (FRPC) | | |
| | | PCHunter | Nanodump | | | | |
| | | EDRKill (echo_driver.sys + DBUtil 2.3) | HandleKatz | | | | |
---
#### Any Related Sources
- icardagt.exe DLL sideloading of version.dll - https://hijacklibs.net/entries/microsoft/built-in/version.html
| Date Published | Report |
|---|---|
| 2025/08/05 | https://www.guidepointsecurity.com/blog/gritrep-akira-sonicwall/ |