Unit 42 linked Jumpy Pisces, also known as Andariel or PLUTONIUM, to an intrusion that preceded Play ransomware deployment and assessed with moderate confidence that the North Korean state-sponsored actor collaborated with Play operators or acted as an initial access broker. The activity began with a compromised user account, then used SMB to spread Sliver and DTrack, maintained C2 until shortly before ransomware execution, and included credential harvesting, privilege escalation, EDR sensor removal, Windows access-token abuse, PsExec use, and Play ransomware deployment.