Ransomware deploys virtual machines to hide itself from antivirus software

The operators of the RagnarLocker ransomware are running Oracle VirtualBox to hide their presence on infected computers inside a Windows XP virtual machine.