Reported by 2 outlets

Timeline

1. original reporting

   Hackers Abuse Windows Shadow Copies to Steal Active Directory Credentials and Kill Ransomware Recovery

   cyberpress.org · 28d ago · September 15th, 2026

   Windows Volume Shadow Copy Service, or VSS, is designed to create point-in-time copies of files and volumes. Administrators and backup products use it to restore data after accidental deletion, corruption, or system failure. However, attackers increasingly abuse the same Windows feature to steal credentials, disrupt recovery, and prepare ransomware attacks . Shadow copies are not a complete backup strategy. They are local copies stored on the affected system, meaning attackers with sufficient access can create, alter, or delete them. Modern ransomware operations often target these copies before encrypting files to make local recovery harder or impossible. The most familiar VSS attack involves deleting shadow copies before ransomware deployment. Threat actors commonly use built-in Windows utilities such as vssadmin , Windows Management Instrumentation, or other system tools to remove snapshots. This behavior maps to MITRE ATT&CK technique T1490, Inhibit System Recovery. Shadow Copies AD Stolen Deleting shadow copies is not always the final stage of an intrusion. It can be one action in a wider attack chain that includes privilege escalation, lateral movement, data theft, and ransomware encryption. By removing local recovery options first, attackers increase pressure on victims to pay. VSS can also support credential theft. Instead of directly accessing a live Active Directory database, attackers may create a shadow copy and copy the NTDS.dit file from it. The file contains Act

2. update from gbhackers.com

   Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware

   gbhackers.com · 28d ago · September 15th, 2026

   Threat actors are increasingly weaponizing Microsoft’s Volume Shadow Copy Service (VSS) for two distinct objectives: removing recovery options before ransomware deployment and extracting credential material from protected Windows files. The shift means VSS telemetry should no longer be treated as a simple backup or disk-maintenance event, but as behavior requiring process, identity, and endpoint context. […] The post Hackers Turn Windows Shadow Copies Into a Tool for Credential Theft and Ransomware appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .