Reported by 1 outlet

Timeline

1. original reporting

   Play Ransomware Masquerades as PsExec With Custom PSexesvc.exe Service

   gbhackers.com · 64d ago · August 11th, 2026

   Play ransomware is deploying a custom service binary named PSexesvc.exe that mimics Microsoft Sysinternals PsExec, hiding in plain sight as routine Windows administration during lateral movement and payload execution. The binary has been observed alongside tools and a ransom note staged in C:\Users\Public\Music\, an unremarkable-looking path during investigations. Play also uses genuine PsExec and WMI for lateral movement, so defenders must treat the T1036 masquerading pattern — not just the binary name — as the detection signal.

2. update from gbhackers.com

   Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration

   gbhackers.com · 64d ago · August 10th, 2026

   Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe. The group’s use of a custom service binary named PSexesvc.exe, mimicking Microsoft Sysinternals PsExec, illustrates how attackers can turn routine Windows administration into cover for lateral movement and payload execution. The tradecraft is classified as MITRE ATT&CK T1036, Masquerading: adversaries make artifacts resemble trusted resources. Play has also used genuine PsExec and Windows Management Instrumentation for lateral movement, meaning defenders must distinguish malicious context from the mere presence of a legitimate tool. The finding comes from Picus’ review of the ten ransomware families with the weakest 2026 prevention results. Play recorded the lowest prevention score, at 13%, followed by BlackByte at 25%. The result does not mean a specific product blocks only 13% of Play activity; it reflects aggregated, anonymized testing of real attack techniques against production controls. Still, it underscores a practical problem: organizations may own endpoint, network, identity, and logging tools while failing to prevent the behavior chains that ransomware operators actually use. Picus Researchers said that , PsExec is especially useful camouflage because enterp