Play Ransomware · 2024-10
Unit 42 linked Jumpy Pisces, also known as Andariel or PLUTONIUM, to an intrusion that preceded Play ransomware deployment and assessed with moderate confidence that the North Korean state-sponsored actor collaborated with Play operators or acted as an initial access broker. The activity began with a compromised user account, then used SMB to spread Sliver and DTrack, maintained C2 until shortly before ransomware execution, and included credential harvesting, privilege escalation, EDR sensor removal, Windows access-token abuse, PsExec use, and Play ransomware deployment.
North Korean State-Sponsored Hacking Group Andariel Compromised An Unnamed Organisation Between May And September 2024 Before Play Ransomware Was Deployed Against The Organisation · 01.05.2024
According to a 30 October 2024 report by Unit42, North Korean state-sponsored hacking group Andariel (aka Jumpy Pisces, Onyx Sleet, fka PLUTONIUM/Silent Chollima/G0138/DarkSeoul) infiltrated an unnamed target in May 2024, leading to persistent access and data theft by the group from May to September 2024. Following the theft of data, Unit42 indicates a potential collaboration with the Play ransomware group, since Play ransomware was deployed against the target at the end of September 2024.
In late May 2024, Andariel compromised the unnamed organisation's network via a compromised user account, and then extracted registry dumps and deployed Mimikatz for credential harvesting. The threat actors solidified their presence on the network over the next few months, establishing command-and-control, stealing data, creating malicious services, establishing Remote Desktop Protocol (RDP) sessions, and uninstalling endpoint detection and response (EDR) tools. In early September 2024, an unknown actor gained access to the same compromised user account and carried out "pre-ransomware activities" (credential harvesting, privilege escalation, etc.) according to Unit42. By the end of the month, Play ransomware was deployed onto the victim's servers.
Unit42 links Andariel to Play with medium confidence due to the fact that Andariel had access to the account up until the day before the deployment of Play ransomware. However, Unit42 also states that Andariel could have simply sold access to the compromised user account to Play, rather than coordinate with the group directly.
Undisclosed organization · 30/10/2024
Researchers at Palo Alto discover a ransomware incident where the threat actor Jumpy Pisces, tied to North Korea, collaborated with the Play ransomware group. [Date Occurred: During May 2024; Date Discovered: Early September 2024]
Intrusion to deploy Play ransomware · May to September 2024
(MSMT/2025/2, report p. 39-40) “From May to September 2024, Andariel actors were discovered using open source and known North Korean malware like Dtrack to execute an intrusion against a victim to deploy Play ransomware. ... The Andariel actors probably have cooperated with or maintain some affiliation with Play ransomware actors”
Jumpy Pisces Engages in Play Ransomware · 2024-10-30T03:00:29
A first-ever collaboration between DPRK-based Jumpy Pisces and Play ransomware signals a possible shift in tactics.
North Korean group using Sliver with Play ransomware (mentioned in Sliver C2 / Y Combinator post) · 2024-11-12T00:00:00.000Z
North Korean Group Using Play Ransomware : North Korean actors deployed Sliver's stealth capabilities to facilitate the execution of Play ransomware, underscoring its utility in advanced evasion techniques.