Published on August 10, 2026
Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration
Severity
Medium
Play ransomware has been observed using a custom Windows service binary named PSexesvc.exe, designed to mimic Microsoft Sysinternals PsExec. This technique falls under MITRE ATT&CK T1036 – Masquerading, where attackers make malicious artifacts appear legitimate to reduce suspicion. The binary was found alongside attack tools and ransom notes in C:\Users\Public\Music\, a user-writable directory that may appear unremarkable during an investigation. Play has also used legitimate PsExec and Windows Management Instrumentation (WMI) for lateral movement, making it important for defenders to assess the surrounding context rather than flagging legitimate administration tools by default.
Picus’ 2026 assessment ranked Play with the lowest prevention score among ten ransomware families at 13%, followed by BlackByte at 25%. The score represents aggregated testing of ransomware techniques against production security controls and does not mean a specific security product blocks only 13% of Play activity. Other techniques observed across the evaluated ransomware families include obfuscated files or information, disabling security tools, process injection, registry modification, reflective code loading, indicator removal, and signed binary proxy execution.
How?
Attackers can abuse the familiarity of legitimate Windows administration tools to blend malicious activity with normal administrative operations. By creating PSexesvc.exe to resemble PsExec, Play can make malicious service creation and remote execution appear legitimate during an intrusion. The group may also use PsExec, WMI, PowerShell, RDP, and administrative shares to execute commands and move laterally across systems, while obfuscation techniques can hide payloads, configurations, and strings from static security controls.
Defenders should therefore evaluate the context surrounding these activities, including the executable path, digital signature, hash, parent process, source host, destination host, user account, and privilege level. A PsExec-like service executable launched from a user-writable directory should receive greater scrutiny than an approved Sysinternals deployment from a controlled administrative system. Additional suspicious activity may include unexpected service creation or termination, Windows Event Log clearing, shadow-copy deletion, and abnormal file-encryption activity occurring within the same timeframe.
Recommendation
Security teams should implement behavioral monitoring for remote execution, service creation, administrative shares, RDP, WMI, and PowerShell, while correlating endpoint, authentication, network, and Windows event logs. Detection rules should consider the executable path, signer, hash, parent process, source and destination hosts, and account privileges rather than simply alerting on the use of PsExec. Organizations should also restrict remote-access services and administrative tools to approved hosts and accounts, enforce MFA for privileged and remote access, segment critical systems, regularly patch internet-facing services, and maintain protected offline backups.
Security teams should establish baselines for legitimate administrative activities, including expected service names, executable locations, execution paths, and administrator accounts. Breach and Attack Simulation (BAS) can also be used to regularly validate whether ransomware behaviors are actually prevented, detected, or missed by existing security controls. The key takeaway is that organizations should not simply block legitimate tools such as PsExec, as they may be required for normal administration. Instead, they should ensure their use is authorized, attributable, and monitored for abnormal behavior.
Source