The Play ransomware group has expanded its operations to target VMware ESXi environments, utilizing a new Linux variant that demonstrates connections to the previously active Puma group. Recent research by Trend Micro indicates that a series of attacks have been directed at VMware ESXi servers, employing double-extortion tactics that have become a hallmark of the Play ransomware group. This development marks a significant escalation in the threat landscape for organizations relying on VMware ESXi virtualization technology.