Play Ransomware is active for a while, but it come under lime light when it attack the Argentina's Judiciary of Córdoba, forcing the judicial system to come to at rest. Unlike most ransomware operations that leave lengthy ransom notes Play ransom notes simple, just the name and a email address.

BlueSky ransomware is an emerging malware it encrypts user data using use ChaCha20 algorithm for file encryption, along with Curve25519 for key generation.

Lilith Ransomware is yet another ransomware that does double-extortion attacks, which is when the threat actors steal data before encrypting devices

RedAlert ransomware or N13V ransomware targets both Windows and Linux VMWare ESXi servers in attacks on corporate networks. The ransomware is named after a string in the ransom text, but the threat actors internally refer to it as N13V, which is the original name of this threat.

AstraLocker 2.0 is closely related to Babuk Ransomware. It encrypts user data and ask $50 USD in XMR (monero) coin. It is distributes via phishing campaigns as Microsoft Office Word documents attachments.