[ahiudyjahfduiao]

For anyone doing analysis work, do you prefer isolated VMs with host-only networking, or fully air-gapped hardware? Trying to set up a safe sandbox and weighing the tradeoffs between convenience and containment.

[Serialist]

I think a local VM is sufficient for analysis and testing. Install all analysis tools and save the snapshot so you can restore freshly over and over afterwards.

[5chn4pp]

I prefer dedicated hardware with no VM and a properly configured router/firewall box in front of that hardware.

Let the malware do its thing on an actual, real machine, and control it properly. There is more to it, but it depends on your workflow.

[psycheuser]

Isolated VMs with host-only networking are usually fine for 99% of standard analysis, especially if you take clean snapshots before execution. However, if you are analyzing advanced malware or ransomware that checks for virtualization indicators or attempts VM escapes, a completely air-gapped physical machine is the only safe bet. For daily drive convenience, a hardened VM using tools like Flare VM or REMnux on an isolated VLAN works best.