Windows Volume Shadow Copy Service (VSS) Abused in Ransomware and Credential Theft Attacks
The Windows Volume Shadow Copy Service (VSS), designed to create point-in-time backups for data recovery, has become a prime target for cyberattackers. While VSS enables administrators to restore files after corruption or deletion, threat actors increasingly exploit it to facilitate ransomware attacks, disrupt recovery efforts, and steal credentials.
Ransomware groups frequently delete shadow copies before encrypting files, eliminating local recovery options and increasing pressure on victims to pay. Attackers commonly use built-in Windows tools like vssadmin or Windows Management Instrumentation (WMI) to remove snapshots a tactic mapped to MITRE ATT&CK technique T1490 (Inhibit System Recovery). However, shadow copy deletion is often just one step in a broader attack chain, which may include privilege escalation, lateral movement, and data exfiltration.
Beyond ransomware, VSS is also leveraged for credential theft. Instead of directly accessing the live Active Directory (AD) database, attackers create a shadow copy and extract the NTDS.dit file, which contains password hashes and other sensitive domain data. This method helps evade detection by avoiding live credential-dumping activity, allowing attackers to expand access across the network.
Additional abuse tactics include modifying shadow copy storage limits or configurations to reduce recovery capacity or conceal malicious activity. While legitimate backup tools and scripts regularly interact with VSS, security teams must monitor for suspicious patterns such as shadow copy deletions followed by file encryption or snapshots created after lateral movement and NTDS.dit access.
A recent attack sequence demonstrated this risk: Threat actors used PsExec to gain SYSTEM-level access on a domain controller, enumerated Remote Desktop sessions, and executed vssadmin create shadow, followed by credential harvesting and DNS reconnaissance. Such behavior underscores the need for contextual detection, as isolated VSS events may appear benign but signal an active intrusion when correlated with other malicious activity.
Source: https://cyberpress.org/shadow-copies-ad-stolen/
Microsoft TPRM report: https://www.rankiteo.com/company/microsoft-security-response-center
"id": "mic1789461009",
"linkid": "microsoft-security-response-center",
"type": "Ransomware",
"date": "9/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'type': ['organization', 'enterprise']}],
'attack_vector': ['VSS exploitation',
'lateral movement',
'privilege escalation'],
'data_breach': {'data_encryption': 'possible (ransomware)',
'data_exfiltration': 'possible',
'file_types_exposed': ['NTDS.dit'],
'personally_identifiable_information': 'password hashes',
'sensitivity_of_data': 'high',
'type_of_data_compromised': ['password hashes',
'sensitive domain data']},
'description': 'The Windows Volume Shadow Copy Service (VSS), designed to '
'create point-in-time backups for data recovery, has become a '
'prime target for cyberattackers. Threat actors exploit VSS to '
'facilitate ransomware attacks, disrupt recovery efforts, and '
'steal credentials. Ransomware groups delete shadow copies '
'before encrypting files, eliminating local recovery options. '
'Attackers also use VSS to extract the NTDS.dit file for '
'credential theft, evading detection by avoiding live '
'credential-dumping activity.',
'impact': {'data_compromised': ['password hashes', 'sensitive domain data'],
'identity_theft_risk': 'high',
'operational_impact': 'disrupted recovery efforts, increased '
'pressure to pay ransom',
'systems_affected': ['Windows systems with VSS enabled',
'domain controllers']},
'initial_access_broker': {'high_value_targets': ['domain controllers']},
'lessons_learned': 'VSS exploitation is a critical attack vector for '
'ransomware and credential theft. Security teams must '
'monitor for suspicious VSS activity patterns, such as '
'shadow copy deletions followed by file encryption or '
'snapshots created after lateral movement and NTDS.dit '
'access.',
'motivation': ['financial gain', 'data exfiltration', 'credential harvesting'],
'post_incident_analysis': {'corrective_actions': ['Implement enhanced '
'monitoring for VSS '
'activity',
'Correlate VSS events with '
'other attack indicators',
'Strengthen backup and '
'recovery strategies'],
'root_causes': 'Exploitation of Windows Volume '
'Shadow Copy Service (VSS) for '
'ransomware and credential theft'},
'ransomware': {'data_encryption': 'yes', 'data_exfiltration': 'possible'},
'recommendations': ['Monitor for suspicious VSS activity patterns',
'Correlate VSS events with other malicious activities '
'(e.g., lateral movement, privilege escalation)',
'Enhance detection for contextual VSS abuse',
'Implement robust backup and recovery strategies '
'independent of VSS'],
'references': [{'source': 'MITRE ATT&CK',
'url': 'https://attack.mitre.org/techniques/T1490/'}],
'response': {'enhanced_monitoring': 'recommended for suspicious VSS activity '
'patterns'},
'title': 'Windows Volume Shadow Copy Service (VSS) Abused in Ransomware and '
'Credential Theft Attacks',
'type': ['ransomware', 'credential theft'],
'vulnerability_exploited': 'Windows Volume Shadow Copy Service (VSS)'}