On-premise, with or without VMs, does not safe you from rowhammer, however. That's just another use case, and not really surprising. Since you can modify RAM, there aren't borders really.

True, but at least in the general case you control your adjacent VMs.

Exactly, its easy to get a VM on any of the major platforms and poke around to see what might be going on in the same host as you.

At least one of the big hosters even lets you have VMs for free for a couple of days (you get your money back if you cancel). That's more than enough time for an automated process to check out tons of VMs (to add to your botnet) for free.

the timing isn't a coincidence. cloud infrastructure is becoming a high-value target for security researchers and cybercriminals precisely because organizations are moving sensitive data into the cloud.

to be clear: i don't mean to lump security researchers and cybercriminals into a common group. it just so happens that they both have motivating interests in this industry shift.