[PLAY] – Ransomware Victim: ConvExx

image

NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the PLAY Onion Dark Web Tor Blog page.

Ransomware group:
PLAY
Victim name:
CONVEXX

AI Generated Summary of the Ransomware Leak Page

ConvExx is identified as the ransomware-leak victim in the observed entry. The post date is November 4, 2025 (timestamp 20:53:27.601214), and ConvExx is described as based in the United States. The industry for ConvExx is not listed in the provided data. No compromise date is given; therefore, the post date is treated as the publication date. The leak page notes the presence of a claim URL, suggesting there is a link for ransom-related information or negotiation. The record does not specify whether the attack encrypted systems or exfiltrated data, and no ransom amount is disclosed. The page contains no screenshots or images (image count is zero) and there are no downloads or additional linked files shown in the dataset. Overall, this entry confirms ConvExx as the victim but does not provide a detailed breach narrative within the available data.

From a threat-context perspective, the lack of an industry classification and explicit impact type means the report offers only high-level information about the incident. The post date stands as the public disclosure date in lieu of a stated breach date. The existence of a defanged claim URL indicates the attackers are providing a link for additional information or ransom-related actions, but the dataset contains no visual artifacts, documents, or attachments to corroborate the claim. The group associated with the post is listed as “play.” Defenders should monitor for any follow-on activity linked to ConvExx and review potential exposure for ConvExx’s customers or partners, while noting that current data provides limited detail about the breach.

Support Our Work

A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.

If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.

AI APIs OSINT driven New features