Akira and Play, ranked as second and third most prolific ransomware groups, respectively.

The Play ransomware group accounted for 5% of disclosed ransomware attacks in 2025.

Play dropped to third place of most active threat groups in June 2025 with 29 attacks.

Play was the fourth most active ransomware group, with 43 attacks in February 2025.