Microchip Technologies, a semiconductor supplier, has been a notable recent victim of the Play ransomware group. The attack involved the exfiltration of sensitive data followed by system encryption, with threats to publish stolen information if ransom demands were not met. This double extortion model has caused significant disruption and potential financial loss for the company.
Source: https://cybersecuritynews.com/play-ransomware-ttps-iocs/
TPRM report: https://scoringcyber.rankiteo.com/company/microchip-technology
"id": "mic742060625",
"linkid": "microchip-technology",
"type": "Ransomware",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Food and Beverage',
'location': 'Global',
'name': 'Krispy Kreme',
'type': 'Retail'},
{'industry': 'Semiconductors',
'location': 'Global',
'name': 'Microchip Technologies',
'type': 'Technology'}],
'attack_vector': ['Remote Code Execution', 'Email Phishing', 'Phone Calls'],
'data_breach': {'data_encryption': True,
'data_exfiltration': True,
'type_of_data_compromised': 'Sensitive Data'},
'date_detected': 'June 2022',
'date_publicly_disclosed': 'June 4, 2025',
'description': 'Federal authorities have revealed that the notorious Play '
'ransomware group has successfully breached approximately 900 '
'organizations worldwide as of May 2025, marking a dramatic '
'escalation in cybercriminal activity that has prompted an '
'urgent security advisory from multiple government agencies.',
'impact': {'data_compromised': ['Sensitive Data'],
'systems_affected': ['Windows', 'ESXi environments']},
'initial_access_broker': {'entry_point': 'SimpleHelp'},
'lessons_learned': 'The importance of enabling multifactor authentication, '
'patching known exploited vulnerabilities, maintaining '
'offline encrypted backups, and implementing IOCs and YARA '
'rules for threat detection.',
'motivation': 'Financial Gain',
'ransomware': {'data_encryption': True,
'data_exfiltration': True,
'ransomware_strain': 'Playcrypt'},
'recommendations': 'Enable multifactor authentication, patch known exploited '
'vulnerabilities, maintain offline encrypted backups, '
'conduct regular vulnerability assessments, and keep all '
'software updated.',
'references': [{'source': 'FBI, CISA, and Australian Cyber Security Centre'}],
'threat_actor': 'Play Ransomware Group',
'title': 'Play Ransomware Group Breaches 900 Organizations Worldwide',
'type': 'Ransomware',
'vulnerability_exploited': ['CVE-2024-57727']}