Skip to content

Play

IntrusionSet · ATTACK:enterprise:G1040

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1040",
  "title": "Play",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1040",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--ecbf507f-6786-4121-a4cc-0fd6a8d3a29d",
  "external_id": "G1040",
  "domain": "enterprise",
  "created": "2024-09-24T19:48:18.278Z",
  "modified": "2026-07-31T18:48:24.924Z",
  "version": "1.0",
  "aliases": [
    "Play"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "CISA Play Ransomware Advisory December 2023",
      "url": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-352a"
    },
    {
      "source_name": "Trend Micro Ransomware Spotlight Play July 2023",
      "url": "https://www.trendmicro.com/vinfo/us/security/news/ransomware-spotlight/ransomware-spotlight-play"
    }
  ]
}

Explicit source assertions (35)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--017d597b-2268-4760-baf0-0cee23906965

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0359

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a952229-6932-4b04-b281-ea83e21f7fb0

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0bea4f92-da4b-483c-81ba-c39b0c58368b

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1048

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--231ed92a-eb30-453c-b808-495807e54857

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1070.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3194bdc2-a0d3-412a-a14a-bc0c4f30bc9c

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--31c3aadb-7979-4ea7-9488-f08b5524bada

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3fabf752-3732-4958-9b2c-e9a2e1ebbd0f

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--48ff3270-ada9-4f02-b4f4-bfd6a3a3865f

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4a50bbbf-990f-4556-86e2-2990bccc90e9

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4b7e9da5-e087-4a1d-8df0-82910bd3b1c3

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5112b872-0d2e-48a7-ac5c-512a3720d46d

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--52e9a2ec-3999-4ec5-bdda-227fc2a79173

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--53c7b735-ba51-43ed-b363-3cf388c97ca0

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e856280-00bc-4b8c-aec4-8ca3fd29ef62

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6d9f27eb-cc6b-4871-b42a-37640f45f8fa

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f376a6a-a5ca-4e06-93c5-87d9a76a59ac

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f82c79c-ef15-4625-b2cf-433e2b600f1e

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1685.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--759f675c-2172-4dcd-b781-571e9577a921

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--857b5251-78d1-4f73-ac6a-e3f231718630

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0645

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--867ca425-de4a-4bab-b7a3-5de71cf95c7e

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--913ea392-e874-463c-bfbf-a84668cfc5b6

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--96673f49-a12b-4d0a-954f-17117b02bfa1

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S1162

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9757987c-36ed-4973-9412-0aba611cc9da

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ad8a8754-3852-440f-926e-22ec8dcf419a

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8ecd33a-190f-4f7d-945d-c258512d76d4

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c33b2278-04ef-4506-8406-37700b797af6

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0521

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c46ab316-6976-41ab-87ea-97f9d435b6cc

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca2d1f51-cbd8-403b-a957-b142ba7895bf

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d92510c1-43d7-4b4c-b3a1-cf7ae0387737

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--de2ef201-d74b-4963-877b-93d669ea7f3b

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e8148225-e246-45c4-b203-2958d0bb07da

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ecc6def4-fd02-484e-8ad5-3fe93ac7c716

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f061c68a-7a2f-4cad-af24-9dc55415f956

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1657

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0cd78a8-82ce-47e8-9ecc-beaaf34248c2

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1685

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fb4e6ac6-49db-43ae-a595-5e1c1c3ad6ec

CISA Play Ransomware Advisory December 2023 · Trend Micro Ransomware Spotlight Play July 2023

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.