Threat Intelligence Tarot
Vol. II · 100
Criminal (suspected Eastern European)
★★★★★
risk 3/5
✦ The Gambit ✦
Play
PlayCrypt · Balloonfly
GovernmentHealthcareCritical infrastructureMunicipalitiesMedia
Active since June 2022 · Financial extortion
The Gambit opens not with a bishop sacrifice but with an exploited ProxyNotShell, advancing pawns through municipal networks until the entire civic infrastructure is in check. It targets governance itself.
Tactics & Techniques
RCN
RDV
INI
EXC
PRS
PRV
EVA
CRD
DSC
LAT
COL
C2
EXF
IMP
Notable Operations
- ◆City of Oakland ransomware attack (2023, state of emergency declared)
- ◆Dallas County breach affecting 300,000 residents
- ◆300+ organizations attacked globally across sectors
- ◆Former Hive RaaS affiliates transitioning to Play
Defenses
- ▸Exchange Server patching prioritized within 24 hours of critical CVE disclosureCIS Control 7 ↗
- ▸SMB access restrictions and lateral movement detection via network monitoringNIST CSF: DE.CM ↗
- ▸VSS and backup integrity protection to prevent ransomware recovery disruptionCIS Control 11 ↗
- ▸Government and municipal tabletop exercises for ransomware scenariosNIST CSF: RC.RP ↗
Reversed: Their Weakness
Its exploitation of known Exchange vulnerabilities is its most exploitable weakness. Fully patched Exchange environments combined with MFA on admin interfaces eliminate its most reliable initial access chains.
Share this adversary profile
Compare →swipe to browse
Related Adversaries
Data sourced from MITRE ATT&CK. For educational purposes.