The Play Ransomware Gang's Alleged Attack on CS Cargo

The Play ransomware gang has allegedly attacked CS Cargo. CS Cargo is a leading provider of road, air, sea, and rail transport services and a comprehensive range of logistics services headquartered in the Czech Republic. Play ransomware uploaded CS Cargo's details to its dark web leak site on June 2nd, claiming it will publish all stolen data on June 11th if CS Cargo fails to pay an unspecified ransom. CS Cargo has neither confirmed nor denied the incident.

About Play Ransomware

Play ransomware (aka PlayCrypt) is a newer ransomware group that emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary, and German hotel chain H-Hotels. Play has similarities to Hive ransomware and is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT for persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques. There is little information on how much Play demands for a ransom, but they have thus far made good on their threats to leak the data of those who refuse payment.

Technical Insights

Play is an evolving RaaS platform known to exploit a known Exchange vulnerability (CVE-2022-41080 - patched by Microsoft in November of 2022) that allows them to leverage a second vulnerability with a ProxyNotShell exploit (CVE-2022-41082) even if a patch had been applied, which then allows the attackers to execute code on the systems remotely. Play leverages PowerTool to disable antivirus tools and security monitoring solutions.