The Play Ransomware Gang's Attack on Kenya Bureau of Standards

The Play ransomware gang has attacked Kenya Bureau of Standards. The Kenya Bureau of Standards (KEBS) is a government agency responsible for the development and implementation of standards and quality assurance systems in Kenya. Established in 1974, KEBS operates under the Ministry of Industrialization, Trade, and Enterprise Development. Play posted Kenya Bureau of Standards to its data leak site on July 7th, threatening to publish all stolen data by July 14th if the organization fails to comply.

Background on Play Ransomware

Play ransomware (aka PlayCrypt) is a newer ransomware group that emerged in the summer of 2022 with high-profile attacks on the City of Oakland, Argentina's Judiciary, and German hotel chain H-Hotels. Play has similarities to Hive ransomware and is known to leverage tools like Cobalt Strike for post-compromise lateral movement and SystemBC RAT for persistence, as well as Mimikatz and living-off-the-land binaries (LOLBins) techniques.

Technical Details of the Attack

Play is an evolving RaaS platform known to exploit a known Exchange vulnerability (CVE-2022-41080 - patched by Microsoft in November of 2022) that allows them to leverage a second vulnerability with a ProxyNotShell exploit (CVE-2022-41082) even if a patch had been applied, which then allows the attackers to execute code on the systems remotely. Play leverages PowerTool to disable antivirus tools and security monitoring solutions.

Tactics and Demands

Play employs tactics similar to both Hive and Nokoyawa ransomware and also attempts double extortion by first exfiltrating victim data with the threat to post it on their leak website. There is little information on how much Play demands for a ransom, but they have made good on their threats to leak the data of those who refuse payment.