The enterprise ransomware response playbook

From opportunistic to targeted

Play emerged in 2022 as “Playcrypt,” hitting smaller businesses. Today's operation is different — roughly 900 organizations compromised as of May 2025 (FBI/CISA advisory, June 4, 2025), with a shift from spray-and-pray to precision strikes on high-value infrastructure. Recovery costs average $4.45M per incident; prevention is the cheaper line item.

What makes Play dangerous in enterprise environments:

• Per-victim malware compilation — evades signature-based detection.
• BadBox 2.0 botnet integration — weaponizes compromised IoT devices as entry points.
• Direct phone threats to executives during negotiations.
• Double extortion — data theft before encryption multiplies leverage against regulated industries.

When ransomware meets critical infrastructure

The UnitedHealth breach showed the cascade. The Change Healthcare subsidiary attack affected 190 million individuals and shut down pharmacy networks nationwide (Reuters, May 15, 2025) — stock dropped, executives resigned, guidance withdrew. The lessons generalize:

• Third-party dependencies — subsidiaries and vendors create attack paths.
• Cascade failures — one compromised system paralyzes interconnected services.
• Regulatory scrutiny — breaches trigger investigations beyond technical recovery.
• Reputation damage — patient trust erodes faster than systems rebuild.

Australia's ACSC joining the Play advisory signals international concern; cross-border attacks complicate both response and legal frameworks.

GPU infrastructure: the new high-value target

Modern groups specifically target GPU-dense environments — concentrated compute that often processes sensitive data, where encryption causes maximum operational disruption. The specific exposure:

• Shared memory architecture — one compromised workload affects others.
• High-privilege service accounts — GPU management requires elevated permissions.
• Complex driver stacks — multiple attack surfaces from kernel to application.
• Limited tooling — traditional EDR struggles with GPU-workload visibility.

Healthcare is acute: GPU-accelerated medical imaging can't tolerate downtime, so every minute of encryption costs more than revenue.

Immediate defensive actions

Based on the FBI/CISA indicators, prioritize these — in order.

1. Harden external entry points

Play exploits remote-management tools like SimpleHelp. Audit all RMM (SimpleHelp, ScreenConnect, TeamViewer); put administrative access behind jump boxes to cut direct exposure; deploy application-aware firewalls to block unauthorized remote tools; and enforce MFA on every external-facing service, no exceptions.

2. Isolate IoT and OT networks

Create dedicated VLANs for all IoT devices with complete isolation from production; deploy IoT-specific gateways watching east-west traffic; write strict firewall rules so IoT devices can't reach GPU clusters; and keep medical-device firmware patched ahead of exploitation.

3. Harden GPU clusters

Implement GPU-level isolation (MIG or equivalent); deploy GPU monitoring that detects cryptomining or encryption activity; enforce least privilege with separate accounts for GPU management; and keep driver stacks current.

4. Strengthen detection and response

Integrate Play IoCs into the SIEM immediately; alert on GPU-utilization spikes that indicate encryption; deploy deception (honeypot GPU nodes) to catch lateral movement; and staff 24/7 SOC coverage during active targeting windows.

Supply chain is part of the perimeter

Healthcare's interconnected ecosystem amplifies impact — UnitedHealth proved that securing your own infrastructure isn't enough when a vendor compromise cascades into your operations. Require SOC 2 Type II (or equivalent) in vendor assessments; route vendor connections through isolated DMZs; mandate 24-hour breach notification contractually; and maintain backup vendor relationships so you can pivot fast during an incident. The threat landscape evolved — defenses have to evolve faster. These are the same defense-in-depth patterns I apply in my own on-prem infrastructure work: layered controls, isolation, and recovery you can actually test.