Recovered 2 Servers from Play Ransomware in 2025
On October 5, 2025, we were contacted by Mike, who reported that his company had been hit by the Play ransomware attack a few days earlier, on October 1. Two of his main servers were encrypted, and all files had been renamed with the .play extension — for example, drive01.vm.play and other similar files. The…