Back Ground.News

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

Ground.News • September 15, 2026

Windows attackers are turning a built-in recovery feature into a tool for disruption. By abusing Volume Shadow Copy Service, intruders can copy protected data, access the Active Directory database, and erase recovery copies after ransomware. The technique blends into Windows activity. Backup software, remote management tools, and administrators may create or remove shadow copies, forcing […]

Threat actors are increasingly weaponizing Microsoft’s Volume Shadow Copy Service (VSS) for two distinct objectives: removing recovery options before ransomware deployment and extracting credential material from protected Windows files. The shift means VSS telemetry should no longer be treated as a simple backup or disk-maintenance event, but as behavior requiring process, identity, and endpoint context.

There is no tracked Bias information for the sources covering this story.

To view factuality data please Upgrade to Premium

To view ownership data please Upgrade to Vantage

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit Windows Shadow Copies for Ransomware and Credential Theft Cybercriminals are increasingly abusing Microsoft’s Volume Shadow Copy Service (VSS) to facilitate ransomware attacks and steal credentials. They achieve this by deleting recovery options before deploying ransomware and extracting sensitive data from protected files, including the Active Directory database. Tools such as vssadmin.exe and diskshadow.exe are commonly used in these attacks, which fall under the MITRE ATT&CK tactic of Inhibit System Recovery. The misuse of VSS has prompted security experts to recommend that organizations treat VSS telemetry as critical behavior requiring context rather than routine maintenance. This shift in understanding is essential for effective detection and response strategies. The threat landscape includes various ransomware families known to exploit VSS, such as LockBit and Conti. Current security measures must evolve to address these sophisticated tactics. 2 sources 65

Extracted Entities

Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (2)

Platforms (1)