Operators of an unknown ransomware gang are using a Python script to encrypt virtual machines hosted on VMware ESXi servers.