New Play ransomware Linux version targets VMware ESXi VMs

Trend Micro has observed Play ransomware deploying a dedicated Linux locker that detects VMware ESXi hosts, powers off virtual machines (using vim-cmd), and encrypts VMFS files appending the .PLAY extension; the group also performs double-extortion and drops ransom notes visible in ESXi consoles. The variant targets ESXi environments to maximize disruption to enterprise operations; the FBI, CISA and ACSC warned the gang had breached roughly 300 organizations through October 2023 and recommended MFA, offline backups, and up-to-date software.