The Play Ransomware Gang's Attack on Rea Magnet Wire

Rea Magnet Wire, also known simply as Rea, is a leading global manufacturer of magnet wire and other electrical materials. Magnet wire, also called winding wire or enameled wire, is a type of insulated wire that is used in the construction of electromagnets, transformers, motors, and other electrical equipment. Rea Magnet Wire specializes in producing high-quality magnet wire products for various industries, including automotive, energy, electronics, and industrial applications.

Threat to Publish Stolen Data

Play posted Rea Magnet Wire to its data leak site on September 19th, threatening to publish all stolen data by September 22nd if the organization fails to pay the ransom. Play (aka PlayCrypt) is a RaaS emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary and German hotel chain H-Hotels, as well as exfiltrating data from Fedpol and the Federal Office for Customs and Border Security (FOCBS). Play has similarities to Hive and Nokoyawa ransomware.

Method of Attack

Play often compromises unpatched Fortinet SSL VPN vulnerabilities to gain access. Play has been observed leveraging Process Hacker, GMER, IOBit and PowerTool to bypass security solutions as well as PowerShell or command script to disable Windows Defender. Play continued to increase attacks through the end of 2022 and into Q1 of 2023 and is one of the most active groups today.

Ransom Demands and Tactics

There is little information on how much Play demands for a ransom, but they have made good on their threats to leak the data of those who refuse payment. Play is an evolving RaaS platform known to leverage PowerTool to disable antivirus tools and security monitoring solutions and SystemBC RAT for persistence. Play is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT executables and legitimate tools Plink and AnyDesk to maintain persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques. Play also abuses AdFind for command-line queries to collect information from a target’s Active Directory.

Innovation and Evasion Techniques

Play innovated the intermittent encryption technique for improved evasion capabilities. Play ransomware gang has mainly focused attacks in Latin America, especially Brazil, but have attack outside of that region. Play employs tactics similar to both Hive and Nokoyawa ransomware, and also attempts double extortion by first exfiltrating victim data with the threat to post it on their leaks website.