VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft
VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy (TL-2026-2505) is a high-severity tracked intrusion set, first published 2026-09-14. It has no confirmed attribution, affects Microsoft Windows Server (Active Directory Domain Controllers) /, maps to 8 MITRE ATT&CK techniques (T1003, T1018, T1021), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-2505
- Threat ID
- TL-2026-2505
- Severity
- HIGH
- Status
- ACTIVE
- Category
- THREAT_INTEL
- First published
- 2026-09-14
- Last reviewed
- 2026-09-14
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- all sectors with windows active directory infrastructure, managed service providers, enterprise it
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy
Malware and tooling: BlackCat - S1068, BlackCat/ALPHV, Conti, LockBit, Ryuk, Sodinokibi, WannaCry - S0366, PSEXEC, ntdsutil, secretsdump.py, vssadmin
Huntress documents three distinct patterns of Volume Shadow Copy Service (VSS) abuse observed in the wild: shadow-copy deletion to inhibit system recovery ahead of ransomware deployment (MITRE ATT&CK T1490), shadow-copy creation to extract the NTDS.dit Active Directory database for credential theft (T1003.003), and manipulation of VSS storage configuration. The reported attack sequence combines PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy operations, and DNS reconnaissance.
How VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy works
Huntress's 'VSS Abuse Explained' (published 2026-09-14, a direct follow-up to its 2026-07-17 'Microsoft VSS: Still Essential, But Not the Whole Story') documents an observed intrusion sequence that abuses Windows' built-in Volume Shadow Copy Service (VSS) for two distinct, complementary adversary goals rather than a single-purpose attack.
First, the attacker used PsExec to spawn a SYSTEM-privileged command shell on a domain controller, then enumerated active Remote Desktop sessions (query user / qwinsta) to map logged-on administrators and identify lateral-movement/impersonation targets. Native DNS reconnaissance followed to support further internal enumeration.
Second, rather than dumping credentials directly from a live LSASS/registry process (which is heavily instrumented by EDR), the attacker created a volume shadow copy with vssadmin create shadow to obtain a point-in-time, lock-free snapshot of the system volume, then copied NTDS.dit and the SYSTEM registry hive out of the shadow device path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\NTDS\NTDS.dit). This is the same volume-shadow-copy NTDS.dit extraction pattern MITRE ATT&CK documents as T1003.003, first popularized publicly in 2013 and since adopted by threat actors ranging from ransomware-affiliated crews (Wizard Spider) to state-sponsored operators (APT28) and financially motivated groups (Scattered Spider) — because it evades direct-file-read detections that key on LSASS or live NTDS.dit access.
Third, and separately, the attacker attempted vssadmin delete shadows /all /quiet — the canonical T1490 Inhibit System Recovery move used by nearly every major ransomware family (LockBit, Conti, BlackCat, REvil, Ryuk, WannaCry) to remove local recovery points immediately before file encryption, denying the victim a fast local-restore path and increasing ransom leverage. In the observed case this deletion attempt was blocked by antivirus. Huntress also reports manipulation of VSS configuration (e.g., shadow-storage resizing), a less common T1490 variant historically seen in Conti tooling that reduces shadow-copy retention/capacity without an outright delete command, which can achieve a similar recovery-inhibition effect while triggering fewer 'delete shadows' detections.
No CVE, CVSS score, specific threat actor, or network/file IOCs were disclosed in the source article; all commands, tool names, and technique groundings below reflect the general tradecraft as independently documented by MITRE ATT&CK and other primary/vendor sources, not incident-specific artifacts unique to the Huntress-observed intrusion. Huntress's core recommendation is to correlate these VSS-related signals with adjacent lateral-movement, session-enumeration, and credential-harvesting activity within a time window rather than alerting on any single VSS event in isolation, since legitimate backup/DR operations also invoke vssadmin.
MITRE ATT&CK techniques used in TL-2026-2505
Credential Access
Discovery
T1018 Remote System Discovery; T1033 System Owner/User Discovery
Lateral Movement
Execution
T1059 Command and Scripting Interpreter; T1569 System Services
Privilege Escalation
Impact
Affected products and versions in VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy
- Microsoft — Windows Server (Active Directory Domain Controllers) / Windows Volume Shadow Copy Service
Vulnerable versions: Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows 10; Windows 11
Remediation for VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy
Immediate actions
- Alert on vssadmin.exe, wmic.exe (shadowcopy), diskshadow.exe, and wbadmin.exe process creation with delete/resize/quiet arguments, correlated against a short time window with lateral-movement and credential-access signals rather than in isolation.
- Restrict and monitor PsExec / remote service-creation activity against domain controllers; alert on PSEXESVC.exe service installs followed by shadow-copy commands.
- Enable and centrally forward Sysmon Event ID 1 (process creation) and Windows Security 4688 for all domain controllers to detect vssadmin/PsExec chains.
- Restrict who can create/delete/resize shadow copies on domain controllers to a documented, alertable backup-service account and hostname pattern.
Workarounds
- Where feasible, disable interactive/remote vssadmin.exe usage for non-backup-service accounts via AppLocker/WDAC while leaving the VSS service itself enabled for legitimate backup software.
- Restrict SMB admin-share (ADMIN$) access and remote service creation used by PsExec-style tooling to a small, monitored set of jump hosts.
Longer-term hardening
- Deploy EDR/behavioral detection that flags shadow-copy creation immediately followed by reads of \Windows\NTDS\NTDS.dit or \Windows\System32\config\SYSTEM from a HarddiskVolumeShadowCopy device path.
- Maintain offline/immutable backups that are not reachable via VSS deletion or resize, so local shadow-copy destruction does not eliminate all recovery options.
- Enforce least-privilege and tiered administration (Tier 0 isolation) for domain controllers to reduce the population of accounts capable of running vssadmin/PsExec against them.
- Deploy detections (e.g., Elastic's 'Volume Shadow Copy Deleted or Resized via VssAdmin' rule class) mapped to MITRE ATT&CK T1490/T1003.003 and tune against documented legitimate backup-tool baselines.
Timeline of VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy
- Security researcher Rob Fuller (mubix) publishes the first widely-cited public method for remotely extracting NTDS.dit domain hashes via Volume Shadow Copy creation, the foundation of what MITRE ATT&CK later formalized as T1003.003.
- Researcher bohops publishes 'Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction,' further documenting VSS-based NTDS.dit extraction tradecraft.
- MITRE ATT&CK formally catalogs Inhibit System Recovery as Enterprise technique T1490, documenting vssadmin/wbadmin/bcdedit/diskshadow shadow-copy and backup destruction as a ransomware-impact technique.
- MITRE ATT&CK formally catalogs OS Credential Dumping: NTDS as sub-technique T1003.003, documenting volume-shadow-copy-based NTDS.dit extraction as used by Wizard Spider, APT28, Fox Kitten, Mustang Panda, Scattered Spider, and MirrorFace.
- CrowdStrike publishes analysis of LockBit 2.0 ransomware's vssadmin/wmic/bcdedit shadow-copy tampering chain, including a documented SHA256 sample, and how Falcon detects/prevents it.
- Huntress publishes 'Microsoft VSS: Still Essential, But Not the Whole Story,' examining VSS's architectural limitations as a recovery mechanism — the direct predecessor article to the VSS-abuse follow-up.
- Huntress publishes 'VSS Abuse Explained,' documenting an observed attack sequence combining PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy creation (NTDS.dit extraction) and deletion (recovery inhibition, blocked by antivirus), VSS configuration manipulation, and DNS reconnaissance.
Sources cited for VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy
- VSS Abuse Explained
- Microsoft VSS: Still Essential, But Not the Whole Story
- Inhibit System Recovery, Technique T1490 - Enterprise | MITRE ATT&CK
- OS Credential Dumping: NTDS, Sub-technique T1003.003 | MITRE ATT&CK
- Behavioral Detection for T1490 - Inhibit System Recovery, Detection Strategy DET0329 | MITRE ATT&CK
- Inhibit System Recovery (T1490) - Eviction Strategies Tool
- How CrowdStrike Prevents Volume Shadow Tampering by LockBit Ransomware
- Volume Shadow Copy Deleted or Resized via VssAdmin
- Extracting Domain Hashes: VSSAdmin
- Volume Shadow Copy NTDS.dit Domain Hashes Remotely - Part 1
- Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction
- PsExec NTDS.dit And SYSTEM Hive Download Utility
- When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR
More in threat intel
- Blockchain-Based C2 Evolution: Nation-State Actors Adopt Smart-Contract C2 (EtherHiding, JADESNOW/INVISIBLEFERRET, SharkStealer)
- Spamhaus H1 2026 Botnet Threat Update: Sliver Overtakes Cobalt Strike as Leading C2 Framework, .cn C&C Domains Surge +771%
- Infostealer Logs Expose Replayable AI Session Tokens and API Keys Enabling MFA Bypass
- China-Based AI Companies Conducting Industrial-Scale Distillation Campaigns Against U.S. Frontier AI Models
- Autonomous AI-agent frameworks automating credential theft and cyber espionage (Google Threat Intelligence Group Q3 2026 AI Threat Tracker)
Detection coverage for TL-2026-2505
As of 2026-09-14, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2505 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.