The 4-month-old ransomware gang is now actively targeting VMware's virtual environments with a second variant of its custom malware.