A virtual machine (VM) is a software-based computer that runs its own operating system and applications on shared physical hardware, isolated from the host and other VMs.
How virtual machines work
A hypervisor divides the processor, memory, storage and network of a physical host among several guest systems. Each VM sees its own virtual hardware and can run Windows, Linux or another OS. VMs are stored as disk image files, so they can be copied, moved between hosts and rolled back with snapshots. Hardware extensions such as Intel VT-x and AMD-V make virtualization fast enough for almost every workload: most cloud servers and corporate data centres run on VMs.
How virtual machines are used in security
- Malware analysis – analysts detonate suspicious files in isolated VMs and restore a clean snapshot afterwards; automated sandboxes work the same way.
- Isolation – risky tasks, test systems and legacy software can run separately from the main system.
- Training and testing – penetration testing labs and security exercises are built from VMs.
Security risks of virtual machines
Malware often checks whether it is running in a VM and stays dormant to avoid analysis (MITRE ATT&CK T1497, Virtualization/Sandbox Evasion). The most serious threat is VM escape – a sandbox escape in which code inside a guest breaks out to the host. The VENOM flaw (CVE-2015-3456) in the QEMU virtual floppy controller is a well-known example. Ransomware groups also target virtualization hosts directly: by encrypting VM disk files on a VMware ESXi server, a single attack can take down dozens of systems at once, as seen in the ESXiArgs ransomware campaign of 2023.
Best practices
- Keep the hypervisor and guest tools patched.
- Restrict access to virtualization management consoles.
- Back up VMs to separate storage that the host cannot overwrite.
