Play attacks John Mulder Heating and Air Conditioning
Incident Date:
July 25, 2023
Overview
Title
Play attacks John Mulder Heating and Air Conditioning
Victim
John Mulder Heatting and Air Conditioning
Attacker
Play
Location
First Reported
July 25, 2023
Play Ransomware Gang Targets John Mulder Heating and Air Conditioning
The Play ransomware gang has attacked John Mulder Heating and Air Conditioning. John Mulder Heating and Air Conditioning is a reputable and established HVAC company known for its expertise in heating, ventilation, and air conditioning services. With a strong presence in the industry, the company has gained recognition for its reliable and professional approach to meeting residential and commercial customers' heating and cooling needs.
The company's services encompass various HVAC solutions, including installing, repairing, and maintaining heating and cooling systems. Whether it's furnaces, air conditioners, heat pumps, or ventilation units, John Mulder Heating and Air Conditioning offers comprehensive solutions to ensure optimal comfort and energy efficiency.
Play posted John Mulder Heating and Air Conditioning to its data leak site on July 25th, claiming to have stolen private and personal confidential data, client and employee documents, HR data, IDs, scans, contracts, finance, and tax documents. The group is threatening to publish all stolen data by July 29th if the organization fails to comply.
About Play Ransomware
Play (aka PlayCrypt) is a RaaS that emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary, and German hotel chain H-Hotels, as well as exfiltrating data from Fedpol and the Federal Office for Customs and Border Security (FOCBS). Play has similarities to Hive and Nokoyawa ransomware.
Play often compromises unpatched Fortinet SSL VPN vulnerabilities to gain access. Play has been observed leveraging Process Hacker, GMER, IOBit, and PowerTool to bypass security solutions and PowerShell or command script to disable Windows Defender. Play continued to increase attacks through the end of 2022 and into Q1 of 2023 and is one of the most active groups today.
There is little information on how much Play demands a ransom, but they have made good on their threats to leak the data of those who refuse payment. Play is an evolving RaaS platform known to leverage PowerTool to disable antivirus tools and security monitoring solutions and SystemBC RAT for persistence. Play is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT executables and legitimate tools Plink and AnyDesk to maintain persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques. Play also abuses AdFind for command-line queries to collect information from a target's Active Directory. Play innovated the intermittent encryption technique for improved evasion capabilities.
Play ransomware gang has mainly focused attacks in Latin America, especially Brazil, but has attacked outside that region. Play employs tactics similar to Hive and Nokoyawa ransomware and attempts double extortion by first exfiltrating victim data with the threat to post it on their leaks website.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.