Attackers Using Virtual Machines

[overlap]

Tactic hides ransomware payload and lowers the risk of discovery while encryption process is underway

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/ransomware-virtual-machines

Ragnar Locker ransomware deploys virtual machine to dodge security

https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/