Product
PLAY
- First Reported
- Oct 16, 2025
- Latest Reported
- Oct 16, 2025
Reported Context (1)
- an incident where the threat actor used a custom tool named ps_bulk.exe, renamed to GoGo.exe, to push a PLAY ransomware executable out to other endpoints within the network, using command lines similar to the Huntress Details How Ransomware Operators Deploy Their Payloads
Malware (8)
People (2)
MITRE ATT&CK (10)
Vendors (1)
Products (11)
Tools (4)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.