The group known as PLAY is using custom tools researchers say allow it to be faster and more efficient when carrying out ransomware attacks.