Play Ransomware Masquerades as PsExec to Blend Into Legitimate Windows Administration

Play ransomware is using a familiar Windows-administration disguise to reduce suspicion during intrusions: a custom service binary named PSexesvc.exe.