Procedure examples

Medusa Ransomware has the capability to terminate services related to backups, security, databases, communication, filesharing and websites. Medusa Ransomware has also utilized the `taskkill /F /IM <process> /T` command to stop targeted processes and `net stop <process>` command to stop designated services.

Olympic Destroyer uses the API call ChangeServiceConfigW to disable all services on the affected system.

BlackByte 2.0 Ransomware can terminate running services.

Conti can stop up to 146 Windows services related to security, backup, database, and email solutions through the use of net stop.

Megazord has the ability to terminate a list of services and processes.

Diavol will terminate services using the Service Control Manager (SCM) API.

BlackCat has the ability to stop VM services on compromised networks.

Ragnar Locker has attempted to stop services associated with business applications and databases to release the lock on files used by these applications so they may be encrypted.

Avaddon looks for and attempts to stop database processes.

Cheerscrypt has the ability to terminate VM processes on compromised hosts through execution of `esxcli vm process kill`.

Babuk can stop specific services related to backups.

Cuba has a hardcoded list of services and processes to terminate.

LockBit 3.0 can terminate targeted processes and services related to security, backup, database management, and other applications that could stop or interfere with encryption.

Netwalker can terminate system processes and services, some of which relate to backup software.

WannaCry attempts to kill processes associated with Exchange, Microsoft SQL Server, and MySQL to make it possible to encrypt their data stores.

Pay2Key can stop the MS SQL service at the end of the encryption process to release files locked by the service.

Royal can use `RmShutDown` to kill applications and services using the resources that are targeted for encryption.

Embargo has terminated active processes and services based on a hardcoded list using the `CloseServiceHandle()` function. Embargo has also leveraged MS4Killer to terminate processes contained in an embedded list of security software process names that were XOR-encrypted.

MegaCortex can stop and disable services on the system.

Akira _v2 can stop running virtual machines.

Ryuk has called kill.bat for stopping services, disabling services and killing processes.

HermeticWiper has the ability to stop the Volume Shadow Copy service.

Pysa can stop services and processes.

LockBit 2.0 can automatically terminate processes that may interfere with the encryption or file extraction processes.

HotCroissant has the ability to stop services on the infected host.

REvil has the capability to stop services and kill processes.

ROADSWEEP can disable critical services and processes.

LookBack can kill processes and delete services.

PHASEJAM has disabled the `cgi-server` process on Ivanti Connect Secure appliances.

Clop can kill several processes and services related to backups and security solutions.

Meteor can disconnect all network adapters on a compromised host using `powershell -Command "Get-WmiObject -class Win32_NetworkAdapter | ForEach { If ($.NetEnabled) { $.Disable() } }" > NUL`.

Maze has stopped SQL services to ensure it can encrypt any database.

VIRTUALPITA can start and stop the `vmsyslogd` service.

KillDisk terminates various processes to get the user to reboot the victim machine.

Qilin can terminate specific services on compromised hosts.

Industroyer’s data wiper module writes zeros into the registry keys in SYSTEM\CurrentControlSet\Services to render a system inoperable.

DRYHOOK has terminated all instances of the `cgi-server` process before activating the modified DSAuth.pm file.

INC Ransomware can issue a command to kill a process on compromised hosts.

SLOTHFULMEDIA has the capability to stop processes and services.

During the 2025 Poland Wiper Attacks, the adversaries deleted Windows Volume Shadow Copies using `vssadmin delete shadows`.

BlackByte resized and deleted volume shadow copy files to prevent system recovery after encryption.

Sandworm Team uses Prestige to delete the backup catalog from the target system using: `C:\Windows\System32\wbadmin.exe delete catalog -quiet` and to delete volume shadow copies using: `C:\Windows\System32\vssadmin.exe delete shadows /all /quiet`.

Scattered Spider has stopped the Volume Shadow Copy service on compromised hosts.

Storm-0501 has deleted snapshots, restore points, storage accounts, and backup services to prevent remediation and restoration. Storm-0501 has also impacted Azure resources through the targeting of `Microsoft.Compute/snapshots/delete`,
`Microsoft.Compute/restorePointCollections/delete`,
`Microsoft.Storage/storageAccounts/delete`, and
`Microsoft.RecoveryServices/Vaults/backupFabrics/protectionContainers/delete`.

Medusa Group has deleted recovery files such as shadow copies using `vssadmin.exe`.

Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.

VOID MANTICORE has deleted virtual machines directly from the virtualization platform.

EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.

RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.

RansomHub has used `vssadmin.exe` to delete volume shadow copies.