Shad0w Security crew

Profile narrative

The threat actor tracked in public reporting under the aliases Shad0w Security crew, Shad0wS3C, and Shad0w Security operates as a financially motivated cybercrime group. The name "Play" is most frequently associated with this actor in vendor and media reporting, and the group is described as adopting a Ransomware-as-a-Service (RaaS) business model, though with structural variations from typical affiliate programs. The operation first emerged in July 2022 and has been linked to a steady stream of victims across multiple countries, with researchers noting similarities in tactics and tooling to the Hive and Nokoyawa ransomware families, leading some analysts to believe Play may be operated by the same individuals behind those now-defunct or diminished groups.

The group's targeting has been broad but shows a clear preference for organizations where disruption and the threat of data exposure carry significant leverage. Reported victims span local and municipal governments, hospitals and healthcare networks, financial institutions, media companies, industrial firms, and shipping and logistics providers. Geographically, Play's earliest confirmed intrusions were against government entities in Latin America, with Brazil identified as a primary initial focus, and the group has since been linked to attacks in the United States, several European countries including Switzerland, Germany, Spain, the Netherlands, France, and Italy, as well as in the Caribbean and Jamaica. Among the more prominent publicly attributed incidents are the ransomware attack on the City of Oakland, California, the breach of Globalcaja in Spain, intrusions against the Swiss media company NZZ and its partner CH Media, the City of Lowell in Massachusetts, the French Rugby Federation, the Italian agricultural organization Coldiretti, and Dutch maritime logistics firm Royal Dirkzwager. Play has also been tied to the attack on Jamaican investment firm Mayberry.

In terms of tactics, techniques, and procedures, Play actors are reported to rely on commonly exploited enterprise vulnerabilities rather than novel zero-days as a primary initial access vector, with public reporting specifically naming the ProxyNotShell flaws in Microsoft Exchange Server as a known exploited pathway. Once inside a target environment, the group has been observed deploying Cobalt Strike for post-exploitation activity and SystemBC RAT for persistence and command-and-control. Play follows a double-extortion model, exfiltrating sensitive corporate and personal data before encrypting systems and then publishing stolen material on a dark web leak site when victims refuse to pay. Victim types of data claimed or confirmed stolen include personal identifiers, passport and government ID information, Social Security numbers, financial records, contracts, employee data, and internal departmental files, with ransom demands typically scaled to the size of the organization and the perceived sensitivity of the data held.

Attribution to a state nexus has not been publicly established, and reporting consistently characterizes Play as a criminal enterprise. There is no credible public reporting tying Shad0w Security crew, Shad0wS3C, or Shad0w Security to a nation-state sponsor, and the group's activities align with financially driven ransomware operations rather than espionage or strategic disruption objectives.

Incidents

Attributed incidents are available to members.

Sources

Sources available to members: 82 sources.