Researchers identified a Linux-based strain hitting ESXi and KVM hosts.

Encryption happens at the hypervisor layer for maximum disruption.