The Play ransomware group, known for double-extortion tactics and advanced evasion techniques, has developed a new Linux variant specifically designed to target VMware ESXi environments. This variant aims to encrypt virtual machines (VMs) and associated files, potentially causing significant operational disruptions. Notably, evidence suggests the Play group may be collaborating with the notorious Prolific Puma cybercriminal entity to enhance its capabilities and circumvent security measures more effectively.