Play Ransomware Targets Jamco Aerospace, Threatens Data Leak Jamco Aerospace, a New York-based engineering firm supplying critical components to aerospace and defense manufacturers including U.S. government contractors was listed on the dark web leak site of the Play ransomware gang on August 6. The attackers set a ransom deadline of August 10, claiming to have exfiltrated sensitive data, including private documents, client records, payroll, financial information, IDs, and tax files. While the exact volume of stolen data remains unspecified, Play has begun releasing portions of it, threatening to publish the rest if Jamco fails to engage. As of now, Jamco Aerospace has not publicly acknowledged the breach, and the authenticity of the leaked data has not been independently verified. Play ransomware has rapidly ascended as a major threat, ranking fourth in victim count (125 reported cases) in Rapid7’s Q2 2025 report nearly double the next most active group. Since 2022, the gang has compromised roughly 900 organizations globally, with tactics outlined in a June 4 joint advisory by CISA, the FBI, and Australia’s ACSC. Attackers initiate contact via unique @gmx.de or @web.de email addresses, and in some cases, phone calls, pressuring victims with threats of data exposure. Play’s operations exploit CVE-2024-57727, a remote code execution vulnerability in SimpleHelp, a remote management tool disclosed in January 2025. The group also employs customized ransomware binaries for each attack, recompiling them to evade detection. Their ESXi variant further disrupts virtualized environments by shutting down VMs, listing machine names, and encrypting VM-related files with per-file encryption keys. If no command-line arguments are provided, the malware automatically powers off all VMs before encryption. The incident underscores Play’s growing sophistication and its focus on high-value targets, particularly in defense and critical infrastructure sectors.