The Play ransomware gang has attacked Dancie Perugini Ware Public Relations. Dancie Perugini Ware Public Relations is a public relations firm headquartered in Houston, Texas. Play published Dancie Perugini Ware Public Relations to its data leak site on June 23rd, claiming to have stolen confidential data, client and employee documents, passports, financial data, and more. Play ransomware (aka PlayCrypt) is a newer ransomware group that emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary, and German hotel chain H-Hotels. Play has similarities to Hive ransomware and is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT for persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques. Play is an evolving RaaS platform known to exploit a known Exchange vulnerability (CVE-2022-41080 - patched by Microsoft in November of 2022) that allows them to leverage a second vulnerability with a ProxyNotShell exploit (CVE-2022-41082) even if a patch had been applied, which then allows the attackers to execute code on the systems remotely. Play leverages PowerTool to disable antivirus tools and security monitoring solutions. Play employs tactics similar to both Hive and Nokoyawa ransomware and also attempts double extortion by first exfiltrating victim data with the threat to post it on their leaks website.
This attack's description was not found, while we work on the detailed account of this attack we invite you to browse through other recent Rasomware Attacks in the table below.