The Attack: Disguise, Deploy, Encrypt
The Play ransomware group has adopted a clever evasion tactic: they use a custom binary named PSexesvc.exe that mimics Microsoft’s legitimate PsExec administration tool. This masquerading technique (MITRE ATT&CK T1036) allows them to blend malicious activity into normal Windows administration workflows, making detection difficult for signature-based security tools.
Picus Security’s 2026 analysis found Play to be the least-prevented ransomware family, with only 13% of its attack techniques blocked by production security controls. The scumbags stage tools and ransom notes in C:\Users\Public\Music — a directory that looks innocuous during investigations. They leverage both genuine PsExec and Windows Management Instrumentation (WMI) for lateral movement, further complicating detection by mixing malicious operations with legitimate administrative activity.
The attack chain depends on several file system operations:
- Writing the fake PSexesvc.exe payload to disk after initial delivery
- Writing tools and ransom notes to the staging directory
- Writing files to remote systems during lateral movement via SMB shares
- Writing encrypted versions of victim files during the encryption phase
Signature-based tools face a fundamental timing problem: they have to wait for a security researcher to find the new variant, analyze it, create a signature, and push an update. Play operates during that window. By the time your antivirus recognizes the threat, the damage is done.
Why Behavioral Detection Isn’t Enough
The article correctly emphasizes behavioral detection — monitoring for suspicious service creation, remote execution patterns, and anomalous encryption activity. That’s good advice. But detection after the payload has landed and started executing is downstream mitigation, not upstream prevention.
If the fake PSexesvc.exe binary has already written itself to disk and started running, you’re now in a race: can your behavioral monitoring detect the attack and respond faster than the ransomware can encrypt files and move laterally? Sometimes you win that race. Sometimes you don’t.
FileSure’s Upstream Intervention: Block the Write Before Execution
FileSure Defend operates at the Windows kernel level via a filter driver that intercepts file system operations before they complete. You define what’s allowed. Everything else is blocked — including ransomware variants nobody has seen before.
Here’s a specific rule configuration that would have stopped Play:
File name filter: *.exe;*.dll;*.bat;*.cmd;*.ps1
Program name filter: outlook.exe;chrome.exe;firefox.exe;msedge.exe;REMOTE ACCESS
Operations: Write, Create
Drive type: Hard drives
Result: Block
This rule prevents email clients, browsers, and remote access sources from writing executable files to local hard drives. When the Play ransomware payload arrives — whether via phishing email, malicious download, or remote execution — the write operation is intercepted and blocked at the kernel level. The file never lands on disk. The attack stops before the binary ever executes.
No signature update required. No waiting for your vendor to catch up. A ransomware variant from this morning is stopped the same way as one from five years ago.
The same mechanism applies to lateral movement. FileSure’s REMOTE ACCESS program filter blocks file write operations originating from remote sources via SMB shares. When Play attempts to write its payload to another system during lateral movement, the write is denied on the target machine. The evildoer can’t propagate across your network because the file system won’t let them write the payload.
And if somehow a payload does land and execute, FileSure’s threshold rules detect and block bulk encryption:
File name filter: * (all files)
Operations: Write, Rename/Move
Threshold: 20 matches within 60 minutes
Result: Block after threshold
Normal user activity — saving documents, editing files — stays well below 20 operations per hour. Ransomware encryption, which modifies hundreds of files per minute, crosses the threshold within seconds. Subsequent write and rename operations are blocked. Damage is contained to the files modified before the threshold fired.
The Broader Point: Prevention Beats Detection
The Picus report’s finding — that only 13% of Play’s techniques are blocked by production controls — reflects a fundamental problem in the security industry. Organizations deploy endpoint tools, network monitoring, and logging infrastructure, then assume they’re protected. But detection coverage on paper does not equal prevention in practice.
FileSure doesn’t try to recognize ransomware. It controls what programs are allowed to do to your files. That’s a more durable defense than chasing attack signatures.
Start your free 21-day trial at bystorm.com and see it work in under three minutes. Install FileSure on a test machine, try to write an executable from your browser, and watch the write get blocked and logged in real time.
Category: Ransomware
Tags: play ransomware, psexec, lateral movement, kernel filter driver, file system security, ransomware prevention, mitre t1036
