Procedure examples

EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.

RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.

RansomHub has used `vssadmin.exe` to delete volume shadow copies.

Prestige can delete the backup catalog from the target system using: `c:\Windows\System32\wbadmin.exe delete catalog -quiet` and can also delete volume shadow copies using: `\Windows\System32\vssadmin.exe delete shadows /all /quiet`.

Playcrypt can use AlphaVSS to delete shadow copies.

Medusa Ransomware has deleted recovery files such as shadow copies using `vssadmin.exe`.

Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.

BlackByte 2.0 Ransomware modifies volume shadow copies during execution in a way that destroys them on the victim machine.

WastedLocker can delete shadow volumes.

ProLock can use vssadmin.exe to remove volume shadow copies.

InvisiMole can can remove all system restore points.

Conti can delete Windows Volume Shadow Copies using vssadmin.

Diavol can delete shadow copies using the `IVssBackupComponents` COM object to call the `DeleteSnapshots` method.

BlackCat can delete shadow copies using `vssadmin.exe delete shadows /all /quiet` and `wmic.exe Shadowcopy Delete`; it can also modify the boot loader using `bcdedit /set {default} recoveryenabled No`.

Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.

Avaddon deletes backups and shadow copies using native system tools.

Conficker resets system restore points and deletes backup files.

HELLOKITTY can delete volume shadow copies on compromised hosts.

Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.

DarkWatchman can delete shadow volumes using vssadmin.exe.

MultiLayer Wiper wipes the boot sector of infected systems to inhibit system recovery.

DEATHRANSOM can delete volume shadow copies on compromised hosts.

Akira will delete system volume shadow copies via PowerShell commands.

DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet”.

LockBit 3.0 can delete volume shadow copies.

Netwalker can delete the infected system's Shadow Volumes to prevent recovery.

WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.

Royal can delete shadow copy backups with vssadmin.exe using the command `delete shadows /all /quiet`.

Embargo has cleared files from the recycle bin by invoking `SHEmptyRecycleBinW()` and disabled Windows recovery through `C:\Windows\System32\cmd.exe /q /c bcdedit /set {default} recoveryenabled no`.

Black Basta can delete shadow copies using vssadmin.exe.

MegaCortex has deleted volume shadow copies using vssadmin.exe.

BlackByte Ransomware deletes all volume shadow copies and restore points among other actions to inhibit system recovery following ransomware deployment.

Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.

HermeticWiper can disable the VSS service on a compromised host using the service control manager.

Pysa has the functionality to delete shadow copies.

LockBit 2.0 has the ability to delete volume shadow copies on targeted hosts.

JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.

ROADSWEEP has the ability to disable `SystemRestore` and Volume Shadow Copies.

Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.

BFG Agonizer wipes the boot sector of infected machines to inhibit system recovery.

Meteor can use `bcdedit` to delete different boot identifiers on a compromised host; it can also use `vssadmin.exe delete shadows /all /quiet` and `C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete`.

Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.

Qilin can execute `vssadmin.exe delete shadows /all /quiet` to remove volume shadow copies and can disable High Availability (HA) and Distributed Resource Scheduler (DRS) in vCenter clusters.

INC Ransomware can delete volume shadow copy backups from victim machines.

FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.

H1N1 disable recovery options and deletes shadow copies from the victim.

BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.