The Play ransomware group is deploying a Linux variant that targets ESXi environments.