Play Ransomware Recovery: What's Recoverable

Play (also known as PlayCrypt) has operated since mid-2022, primarily using phishing, exposed services, and known Microsoft Exchange (ProxyNotShell) and FortiOS SSL VPN vulnerabilities for initial access. It uses AES-RSA hybrid encryption, appends a .play extension, and leaves a single ransom note at the root of the C: drive rather than one per folder.

Play's documented targeting explicitly includes organizations with valuable databases and backup systems, running on Windows, Linux and ESXi. Before encrypting, it disables security services and deletes shadow copies — specifically to remove the easiest, built-in recovery paths before they can be used.

Because the shadow-copy and security-service disabling is a deliberate step, the actual obstacle to recovery after a Play incident is often that step rather than the encryption itself — meaning file-level and database-level recovery from the underlying storage, rather than relying on Windows' own restore points, is usually the realistic path. Preserve the current state of affected systems and get an assessment of what's actually still intact on disk before assuming the loss is total.