Play attacks Unico Data
Incident Date:
June 2, 2023
Overview
Title
Play attacks Unico Data
Victim
Unico Data
Attacker
Play
Location
First Reported
June 2, 2023
The Play Ransomware Gang's Attack on Unico Data
The Play ransomware gang has attacked Unico Data. Unico Data designs IT solutions to facilitate the smooth operation of Swiss companies. Unico Data has 29 employees and is headquartered in Switzerland. Play published Unico Data's details to its dark web leak site on June 2nd, claiming it will publish all 2.8TB of company data by June 11th if the company fails to pay an unspecified ransom.
A message left on Unico Data's answering machine confirmed the attack, saying: "Unfortunately, we are currently affected by a cyberattack, which has led to a precautionary shutdown of all systems." The incident has had knock-on effects on other European companies, including Pathe, PB Swiss Tools, and Boes Group.
Background on Play Ransomware
Play ransomware (aka PlayCrypt) is a newer ransomware group that emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary, and German hotel chain H-Hotels. Play has similarities to Hive ransomware and is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT for persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques. There is little information on how much Play demands for a ransom, but they have thus far made good on their threats to leak the data of those who refuse payment.
Recent Ransomware Attacks
The Recent Ransomware Attacks (RRA) site acts as a watchtower, providing you with near real-time ransomware tracking of attacks, groups and their victims. Given threat actors’ overarching, lucrative success so far, ransomware attacks have become the most ubiquitous, and financially and informationally impactful cyber threat to businesses and organizations today.
The site’s data is generated based on hosting choices of real-world threat actors, and a handful of other trackers. While sanitization efforts have been taken, we cannot guarantee 100% accuracy of the data. Attack updates will be made as source data is reported by reputable sources. By viewing, accessing, or using RRA you acknowledge you are doing so at your own risk.