Play Ransomware Exploits PsExec Disguise to Evade Detection The Play ransomware group has adopted a deceptive tactic to blend into legitimate Windows administration activity, using a custom binary named PSexesvc.exe a near-identical mimic of Microsoft Sysinternals’ PsExec tool. This masquerading technique (MITRE ATT&CK T1036) allows attackers to execute lateral movement and payload deployment while evading suspicion, as the binary appears routine to defenders. The malware has been observed staging tools and ransom notes in C:\Users\Public\Music\, a seemingly innocuous directory that may go unnoticed during investigations. Play also leverages genuine PsExec and Windows Management Instrumentation (WMI) for lateral movement, complicating detection efforts by blending malicious activity with legitimate administrative workflows. Recent findings from Picus Security highlight Play’s evasion prowess, ranking it as the least-prevented ransomware family in 2026 simulations, with only 13% of its attack techniques blocked by production security controls. The analysis, based on aggregated testing of real-world attack chains, underscores a critical gap: organizations often deploy endpoint, network, and logging tools but fail to detect the behavioral sequences ransomware operators exploit. Key evasion techniques employed by Play and other low-prevention families include: - Obfuscated files (T1027): Encrypting payloads and configurations to bypass static scanners. - Security tool tampering: Disabling or modifying defenses. - Process injection, registry modification, and reflective code loading. - Signed binary abuse: Leveraging trusted executables for proxy execution. For defenders, behavioral detection is critical. Security teams should prioritize monitoring for: - Remote execution (PsExec, WMI, PowerShell, RDP). - Suspicious service creation (e.g., PSexesvc launched from user-writable directories like Public\Music). - Abrupt service stoppages, Event Log clearing, or shadow-copy deletion. - Anomalous encryption activity in the same timeframe. Mitigation recommendations align with CISA’s Play ransomware advisory, emphasizing: - Reducing remote-access exposure and patching internet-facing services. - Enforcing MFA for privileged and remote accounts. - Network segmentation and restricting administrative tools to approved hosts. - Offline backups to mitigate encryption impacts. The broader takeaway: detection coverage on paper does not equal prevention in practice. Organizations must validate defenses against real-world attack chains, baselining approved workflows and correlating telemetry across endpoints, authentication logs, and network events. While banning PsExec outright is impractical, defenders should ensure its abuse is visible, attributable, and actionable.