Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration

Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe.

The group’s use of a custom service binary named PSexesvc.exe, mimicking Microsoft Sysinternals PsExec, illustrates how attackers can turn routine Windows administration into cover for lateral movement and payload execution.

The binary has been observed alongside tools and a ransom note staged in C:\Users\Public\Music\, a path that can appear unremarkable during an investigation.

The tradecraft is classified as MITRE ATT&CK T1036, Masquerading: adversaries make artifacts resemble trusted resources.

Play has also used genuine PsExec and Windows Management Instrumentation for lateral movement, meaning defenders must distinguish malicious context from the mere presence of a legitimate tool.

The finding comes from Picus’ review of the ten ransomware families with the weakest 2026 prevention results. Play recorded the lowest prevention score, at 13%, followed by BlackByte at 25%.

The result does not mean a specific product blocks only 13% of Play activity; it reflects aggregated, anonymized testing of real attack techniques against production controls.

Still, it underscores a practical problem: organizations may own endpoint, network, identity, and logging tools while failing to prevent the behavior chains that ransomware operators actually use.

Picus Researchers said that, PsExec is especially useful camouflage because enterprise administrators commonly use it to execute commands on remote Windows systems.

Across the least-prevented families, T1027 Obfuscated Files or Information was the most prevalent evasion method.

Encrypting or encoding embedded payloads, configuration, and strings deprives static scanners of reliable content to inspect.

Play Ransomware Mimics PsExec

Other recurring techniques include disabling or modifying security tools, process injection, indicator removal, registry modification, reflective code loading, hidden artifacts, signed-system-binary proxy execution, and execution guardrails.

For Play specifically, security teams should prioritize behavioral detections around remote execution, service creation, administrative shares, RDP, WMI, and PowerShell.

Alerting should weigh executable path, signer, hash, parent process, remote source, account privilege, and destination host not simply flag every PsExec event.

A PSexesvc-like service launched from a user-writable public directory deserves more scrutiny than an approved Sysinternals deployment from a managed administration share.

Analysts should also investigate abrupt service stoppages, Event Log clearing, shadow-copy deletion, and abnormal encryption activity in the same time window.

The mitigation baseline remains familiar but must be continuously tested: remove unneeded remote-access exposure, patch internet-facing services, enforce MFA for privileged and remote access, segment critical assets, restrict administrative tooling to approved hosts and accounts, and retain protected offline backups.

CISA’s Play ransomware advisory likewise recommends monitoring abnormal activity, limiting remote-service access, auditing privileged accounts, and aligning defensive technologies to observed ATT&CK techniques.

The larger lesson is that detection coverage on paper is not prevention in practice.

Breach-and-attack simulation can safely exercise representative ransomware behaviors against production controls to show what was blocked, logged, or missed.

Picus says its BAS platform and Threat Library provide per-technique validation, while its Mitigation Library maps gaps to vendor-specific and vendor-neutral guidance.

That requires baselining approved administrative workflows, documenting expected service names and execution paths, and ensuring analysts can correlate endpoint, authentication, network, and Windows event telemetry quickly when a supposedly legitimate tool appears on critical hosts.

Defenders should not ban PsExec wholesale; they should make abuse visible and attributable.

Why use the 2026 Agentic SOC Buyer’s Guide? 8 Best Platforms Compared – Download the 2026 Buyer’s Guide