VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft

VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy (TL-2026-2505) is a high-severity tracked intrusion set, first published 2026-09-14. It has no confirmed attribution, affects Microsoft Windows Server (Active Directory Domain Controllers) /, maps to 8 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2505

Threat ID
TL-2026-2505
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-09-14
Last reviewed
2026-09-14
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
all sectors with windows active directory infrastructure, managed service providers, enterprise it
Target regions
Global
Detection rules
9
Indicators of compromise
13

Malware and tooling in VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy

Malware and tooling: BlackCat - S1068, BlackCat/ALPHV, Conti, LockBit, Ryuk, Sodinokibi, WannaCry - S0366, PSEXEC, ntdsutil, secretsdump.py, vssadmin

Huntress documents three distinct patterns of Volume Shadow Copy Service (VSS) abuse observed in the wild: shadow-copy deletion to inhibit system recovery ahead of ransomware deployment (MITRE ATT&CK T1490), shadow-copy creation to extract the NTDS.dit Active Directory database for credential theft (T1003.003), and manipulation of VSS storage configuration. The reported attack sequence combines PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy operations, and DNS reconnaissance.

How VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy works

Huntress's 'VSS Abuse Explained' (published 2026-09-14, a direct follow-up to its 2026-07-17 'Microsoft VSS: Still Essential, But Not the Whole Story') documents an observed intrusion sequence that abuses Windows' built-in Volume Shadow Copy Service (VSS) for two distinct, complementary adversary goals rather than a single-purpose attack.

First, the attacker used PsExec to spawn a SYSTEM-privileged command shell on a domain controller, then enumerated active Remote Desktop sessions (query user / qwinsta) to map logged-on administrators and identify lateral-movement/impersonation targets. Native DNS reconnaissance followed to support further internal enumeration.

Second, rather than dumping credentials directly from a live LSASS/registry process (which is heavily instrumented by EDR), the attacker created a volume shadow copy with vssadmin create shadow to obtain a point-in-time, lock-free snapshot of the system volume, then copied NTDS.dit and the SYSTEM registry hive out of the shadow device path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\NTDS\NTDS.dit). This is the same volume-shadow-copy NTDS.dit extraction pattern MITRE ATT&CK documents as T1003.003, first popularized publicly in 2013 and since adopted by threat actors ranging from ransomware-affiliated crews (Wizard Spider) to state-sponsored operators (APT28) and financially motivated groups (Scattered Spider) — because it evades direct-file-read detections that key on LSASS or live NTDS.dit access.

Third, and separately, the attacker attempted vssadmin delete shadows /all /quiet — the canonical T1490 Inhibit System Recovery move used by nearly every major ransomware family (LockBit, Conti, BlackCat, REvil, Ryuk, WannaCry) to remove local recovery points immediately before file encryption, denying the victim a fast local-restore path and increasing ransom leverage. In the observed case this deletion attempt was blocked by antivirus. Huntress also reports manipulation of VSS configuration (e.g., shadow-storage resizing), a less common T1490 variant historically seen in Conti tooling that reduces shadow-copy retention/capacity without an outright delete command, which can achieve a similar recovery-inhibition effect while triggering fewer 'delete shadows' detections.

No CVE, CVSS score, specific threat actor, or network/file IOCs were disclosed in the source article; all commands, tool names, and technique groundings below reflect the general tradecraft as independently documented by MITRE ATT&CK and other primary/vendor sources, not incident-specific artifacts unique to the Huntress-observed intrusion. Huntress's core recommendation is to correlate these VSS-related signals with adjacent lateral-movement, session-enumeration, and credential-harvesting activity within a time window rather than alerting on any single VSS event in isolation, since legitimate backup/DR operations also invoke vssadmin.

MITRE ATT&CK techniques used in TL-2026-2505

Credential Access

T1003 OS Credential Dumping

Discovery

T1018 Remote System Discovery; T1033 System Owner/User Discovery

Lateral Movement

T1021 Remote Services

Execution

T1059 Command and Scripting Interpreter; T1569 System Services

Privilege Escalation

T1078 Valid Accounts

Impact

T1490 Inhibit System Recovery

Affected products and versions in VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy

  • Microsoft — Windows Server (Active Directory Domain Controllers) / Windows Volume Shadow Copy Service
    Vulnerable versions: Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows 10; Windows 11

Remediation for VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy

Immediate actions

  • Alert on vssadmin.exe, wmic.exe (shadowcopy), diskshadow.exe, and wbadmin.exe process creation with delete/resize/quiet arguments, correlated against a short time window with lateral-movement and credential-access signals rather than in isolation.
  • Restrict and monitor PsExec / remote service-creation activity against domain controllers; alert on PSEXESVC.exe service installs followed by shadow-copy commands.
  • Enable and centrally forward Sysmon Event ID 1 (process creation) and Windows Security 4688 for all domain controllers to detect vssadmin/PsExec chains.
  • Restrict who can create/delete/resize shadow copies on domain controllers to a documented, alertable backup-service account and hostname pattern.

Workarounds

  • Where feasible, disable interactive/remote vssadmin.exe usage for non-backup-service accounts via AppLocker/WDAC while leaving the VSS service itself enabled for legitimate backup software.
  • Restrict SMB admin-share (ADMIN$) access and remote service creation used by PsExec-style tooling to a small, monitored set of jump hosts.

Longer-term hardening

  • Deploy EDR/behavioral detection that flags shadow-copy creation immediately followed by reads of \Windows\NTDS\NTDS.dit or \Windows\System32\config\SYSTEM from a HarddiskVolumeShadowCopy device path.
  • Maintain offline/immutable backups that are not reachable via VSS deletion or resize, so local shadow-copy destruction does not eliminate all recovery options.
  • Enforce least-privilege and tiered administration (Tier 0 isolation) for domain controllers to reduce the population of accounts capable of running vssadmin/PsExec against them.
  • Deploy detections (e.g., Elastic's 'Volume Shadow Copy Deleted or Resized via VssAdmin' rule class) mapped to MITRE ATT&CK T1490/T1003.003 and tune against documented legitimate backup-tool baselines.

Timeline of VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy

  • Security researcher Rob Fuller (mubix) publishes the first widely-cited public method for remotely extracting NTDS.dit domain hashes via Volume Shadow Copy creation, the foundation of what MITRE ATT&CK later formalized as T1003.003.
  • Researcher bohops publishes 'Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction,' further documenting VSS-based NTDS.dit extraction tradecraft.
  • MITRE ATT&CK formally catalogs Inhibit System Recovery as Enterprise technique T1490, documenting vssadmin/wbadmin/bcdedit/diskshadow shadow-copy and backup destruction as a ransomware-impact technique.
  • MITRE ATT&CK formally catalogs OS Credential Dumping: NTDS as sub-technique T1003.003, documenting volume-shadow-copy-based NTDS.dit extraction as used by Wizard Spider, APT28, Fox Kitten, Mustang Panda, Scattered Spider, and MirrorFace.
  • CrowdStrike publishes analysis of LockBit 2.0 ransomware's vssadmin/wmic/bcdedit shadow-copy tampering chain, including a documented SHA256 sample, and how Falcon detects/prevents it.
  • Huntress publishes 'Microsoft VSS: Still Essential, But Not the Whole Story,' examining VSS's architectural limitations as a recovery mechanism — the direct predecessor article to the VSS-abuse follow-up.
  • Huntress publishes 'VSS Abuse Explained,' documenting an observed attack sequence combining PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy creation (NTDS.dit extraction) and deletion (recovery inhibition, blocked by antivirus), VSS configuration manipulation, and DNS reconnaissance.

Sources cited for VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy

More in threat intel

Detection coverage for TL-2026-2505

As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2505 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats