RagnarLocker Deploys a Virtual Machine to Hide Ransomware

Ragnar Gang’s Innovation: Installing Oracle VirtualBox Windows XP Virtual Machine
As ransomware gangs continue to try and boost their illicit profits, the RagnarLocker ransomware gang has brought a new tactic to bear: installing a full virtual machine on victims’ systems to hide their crypto-locking malware while it forcibly encrypts files, warns security firm Sophos.