# VSS Abuse: Attackers Weaponize Windows Volume Shadow Copy Service for Ransomware Prep and Credential Theft

> Huntress documents three distinct patterns of Volume Shadow Copy Service (VSS) abuse observed in the wild: shadow-copy deletion to inhibit system recovery ahead of ransomware deployment (MITRE ATT&CK T1490), shadow-copy creation to extract the NTDS.dit Active Directory database for credential theft (T1003.003), and manipulation of VSS storage configuration. The reported attack sequence combines PsExec-spawned SYSTEM shells, RDP session enumeration, vssadmin-based shadow-copy operations, and DNS reconnaissance.

- **Published:** 2026-09-14T00:00:00Z
- **Last reviewed:** 2026-09-14T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2505
- **ID:** TL-2026-2505
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Huntress's 'VSS Abuse Explained' (published 2026-09-14, a direct follow-up to its 2026-07-17 'Microsoft VSS: Still Essential, But Not the Whole Story') documents an observed intrusion sequence that abuses Windows' built-in Volume Shadow Copy Service (VSS) for two distinct, complementary adversary goals rather than a single-purpose attack.

First, the attacker used PsExec to spawn a SYSTEM-privileged command shell on a domain controller, then enumerated active Remote Desktop sessions (query user / qwinsta) to map logged-on administrators and identify lateral-movement/impersonation targets. Native DNS reconnaissance followed to support further internal enumeration.

Second, rather than dumping credentials directly from a live LSASS/registry process (which is heavily instrumented by EDR), the attacker created a volume shadow copy with vssadmin create shadow to obtain a point-in-time, lock-free snapshot of the system volume, then copied NTDS.dit and the SYSTEM registry hive out of the shadow device path (\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyN\Windows\NTDS\NTDS.dit). This is the same volume-shadow-copy NTDS.dit extraction pattern MITRE ATT&CK documents as T1003.003, first popularized publicly in 2013 and since adopted by threat actors ranging from ransomware-affiliated crews (Wizard Spider) to state-sponsored operators (APT28) and financially motivated groups (Scattered Spider) — because it evades direct-file-read detections that key on LSASS or live NTDS.dit access.

Third, and separately, the attacker attempted vssadmin delete shadows /all /quiet — the canonical T1490 Inhibit System Recovery move used by nearly every major ransomware family (LockBit, Conti, BlackCat, REvil, Ryuk, WannaCry) to remove local recovery points immediately before file encryption, denying the victim a fast local-restore path and increasing ransom leverage. In the observed case this deletion attempt was blocked by antivirus. Huntress also reports manipulation of VSS configuration (e.g., shadow-storage resizing), a less common T1490 variant historically seen in Conti tooling that reduces shadow-copy retention/capacity without an outright delete command, which can achieve a similar recovery-inhibition effect while triggering fewer 'delete shadows' detections.

No CVE, CVSS score, specific threat actor, or network/file IOCs were disclosed in the source article; all commands, tool names, and technique groundings below reflect the general tradecraft as independently documented by MITRE ATT&CK and other primary/vendor sources, not incident-specific artifacts unique to the Huntress-observed intrusion. Huntress's core recommendation is to correlate these VSS-related signals with adjacent lateral-movement, session-enumeration, and credential-harvesting activity within a time window rather than alerting on any single VSS event in isolation, since legitimate backup/DR operations also invoke vssadmin.

## MITRE ATT&CK

- T1569 System Services
- T1059 Command and Scripting Interpreter
- T1078 Valid Accounts
- T1003 OS Credential Dumping
- T1033 System Owner/User Discovery
- T1018 Remote System Discovery
- T1021 Remote Services
- T1490 Inhibit System Recovery

## Sources

- [VSS Abuse Explained](https://www.huntress.com/blog/vss-abuse-explained)
- [Microsoft VSS: Still Essential, But Not the Whole Story](https://www.huntress.com/blog/microsoft-vss-limits-and-best-practices)
- [Inhibit System Recovery, Technique T1490 - Enterprise | MITRE ATT&CK](https://attack.mitre.org/techniques/T1490/)
- [OS Credential Dumping: NTDS, Sub-technique T1003.003 | MITRE ATT&CK](https://attack.mitre.org/techniques/T1003/003/)
- [Behavioral Detection for T1490 - Inhibit System Recovery, Detection Strategy DET0329 | MITRE ATT&CK](https://attack.mitre.org/detectionstrategies/DET0329/)
- [Inhibit System Recovery (T1490) - Eviction Strategies Tool](https://www.cisa.gov/eviction-strategies-tool/info-attack/T1490)
- [How CrowdStrike Prevents Volume Shadow Tampering by LockBit Ransomware](https://www.crowdstrike.com/en-us/blog/how-crowdstrike-prevents-volume-shadow-tampering-by-lockbit-ransomware/)
- [Volume Shadow Copy Deleted or Resized via VssAdmin](https://www.elastic.co/guide/en/security/current/volume-shadow-copy-deleted-or-resized-via-vssadmin.html)
- [Extracting Domain Hashes: VSSAdmin](https://akimbocore.com/article/extracting-domain-hashes-vssadmin/)
- [Volume Shadow Copy NTDS.dit Domain Hashes Remotely - Part 1](https://malicious.link/posts/2013/2013-06-10-volume-shadow-copy-ntdsdit-domain-hashes-remotely-part-1/)
- [Vshadow: Abusing the Volume Shadow Service for Evasion, Persistence, and Active Directory Database Extraction](https://bohops.com/2018/02/10/vshadow-abusing-the-volume-shadow-service-for-evasion-persistence-and-active-directory-database-extraction/)
- [PsExec NTDS.dit And SYSTEM Hive Download Utility](https://www.rapid7.com/db/modules/auxiliary/admin/smb/psexec_ntdsgrab/)
- [When AD Gets Breached: Detecting NTDS.dit Dumps and Exfiltration with Trellix NDR](https://www.trellix.com/blogs/research/detecting-ntdsdit-dumps-exfiltration-with-trellix-ndr/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2505