Play Ransomware Targets Jamco Aerospace, Threatens Data Leak Jamco Aerospace, a New York-based engineering firm supplying critical components to aerospace and defense manufacturers including U.S. government contractors has been listed as a victim of the Play ransomware group. The attackers posted the company’s name on their dark web leak site on Wednesday, August 6, setting a ransom deadline of Sunday, August 10. Play claims to have exfiltrated sensitive data, including private and personal records, client documents, payroll, financial information, IDs, and tax files, though the exact volume of stolen data remains unspecified. After the deadline passed, the group released a portion of the data and warned that the rest would be published unless Jamco Aerospace engaged with them. As of now, the company has not publicly acknowledged the attack, and the authenticity of the leaked data has not been independently verified. Play ransomware has emerged as one of the most active threat groups, ranking fourth in victim count with 125 reported attacks in a recent quarter nearly double the next most prolific gang. Since May 2025, the group has compromised roughly 900 organizations globally, according to a joint advisory from CISA, the FBI, and Australia’s ACSC. Attackers typically initiate contact via unique @gmx.de or @web.de email addresses, with some victims also receiving phone calls pressuring them to pay. The group has exploited CVE-2024-57727, a critical vulnerability in SimpleHelp, a remote management tool, to gain initial access. Once inside a network, Play deploys custom-compiled ransomware binaries for each attack, altering file hashes to evade detection. Their malware includes an ESXi variant that shuts down virtual machines, lists active systems, and encrypts VM-related files using per-file encryption keys. The ransomware also modifies the ESXi welcome message to display the attackers’ demands. With no public response from Jamco Aerospace, the full extent of the breach and its potential impact on aerospace supply chains remains unclear.