Hackers Turn Windows Shadow Copies Into A Tool For Credential Theft And Ransomware

www.itsecuritynews.info • September 15, 2026

Threat actors are increasingly weaponizing Microsoft’s Volume Shadow Copy Service (VSS) for two distinct objectives: removing recovery options before ransomware deployment and extracting credential material from protected Windows files. The shift means VSS telemetry should no longer be treated as a simple backup or disk-maintenance event, but as behavior requiring process, identity, and endpoint context. […]

Read the original article:

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Threat Actors Exploit Windows Shadow Copies for Ransomware and Credential Theft Cybercriminals are increasingly abusing Microsoft’s Volume Shadow Copy Service (VSS) to facilitate ransomware attacks and steal credentials. They achieve this by deleting recovery options before deploying ransomware and extracting sensitive data from protected files, including the Active Directory database. Tools such as vssadmin.exe and diskshadow.exe are commonly used in these attacks, which fall under the MITRE ATT&CK tactic of Inhibit System Recovery. The misuse of VSS has prompted security experts to recommend that organizations treat VSS telemetry as critical behavior requiring context rather than routine maintenance. This shift in understanding is essential for effective detection and response strategies. The threat landscape includes various ransomware families known to exploit VSS, such as LockBit and Conti. Current security measures must evolve to address these sophisticated tactics. 2 sources 65

Extracted Entities

Hackers Turn Windows Shadow Copies Into A Tool For Credential Theft And Ransomware

The full story

Extracted Entities

Attack Types (1)

MITRE ATT&CK (3)

Platforms (1)