Threat Actors Exploit Windows Shadow Copies for Ransomware and Credential Theft

• •Attackers exploit VSS to delete recovery options and steal credentials.
• •Common tools used include vssadmin.exe and diskshadow.exe.
• •MITRE ATT&CK tracks VSS abuse under Inhibit System Recovery.

Cybercriminals are increasingly abusing Microsoft’s Volume Shadow Copy Service (VSS) to facilitate ransomware attacks and steal credentials. They achieve this by deleting recovery options before deploying ransomware and extracting sensitive data from protected files, including the Active Directory database. Tools such as vssadmin.exe and diskshadow.exe are commonly used in these attacks, which fall under the MITRE ATT&CK tactic of Inhibit System Recovery. The misuse of VSS has prompted security experts to recommend that organizations treat VSS telemetry as critical behavior requiring context rather than routine maintenance. This shift in understanding is essential for effective detection and response strategies. The threat landscape includes various ransomware families known to exploit VSS, such as LockBit and Conti. Current security measures must evolve to address these sophisticated tactics.