Play ransomware crims exploit SimpleHelp flaw in double-extortion schemes

Groups linked with the Play ransomware have exploited more than 900 organizations, the FBI said Wednesday, and have developed a number of new techniques in their double-extortion campaigns - including exploiting a security flaw in remote-access tool SimpleHelp if orgs haven't patched it. This particular ransomware variant was among the top five targeting critical infrastructure last year. And according to a Wednesday cybersecurity advisory, the criminals don't seem to be slowing down in their double-extortion attacks, in which they first steal and encrypt sensitive data, then threaten to release it online unless the victims pay up. "Ransom notes do not include an initial ransom demand or payment instructions; rather, victims are instructed to contact the threat actors via email," the FBI, Cybersecurity and Infrastructure Security Agency, and Australian Signals Directorate's Cyber Security Centre said in a June 4 update to an earlier Play ransomware alert. The update includes new tactics, techniques, and procedures Play uses, along with current indicators of compromise to help network defenders protect their organizations from the ransomware crew. Among these: the ransomware notes contain a unique @gmx.de or @web[.]de email for communications. Plus, in a move that screams psychological manipulation, Play operators regularly call their victims and threaten to release their stolen data if they don't pay up. "These calls can be routed to a variety of phone numbers within the orga...