Inhibit System Recovery

Akira will delete system volume shadow copies via PowerShell commands.^[9]

Avaddon deletes backups and shadow copies using native system tools.^[10][11]

Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.^[12][13]

BFG Agonizer wipes the boot sector of infected machines to inhibit system recovery.^[14]

BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.^[15]

Black Basta can delete shadow copies using vssadmin.exe.^{[16][17][18][19][20][21][22][23][23][24]}

BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.^[25]

Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.^[26]

Conficker resets system restore points and deletes backup files.^[27]

Conti can delete Windows Volume Shadow Copies using vssadmin.^[28]

DarkGate can delete system restore points through the command cmd.exe /c vssadmin delete shadows /for=c: /all /quiet".^[29]

DarkWatchman can delete shadow volumes using vssadmin.exe.^[30]

DEATHRANSOM can delete volume shadow copies on compromised hosts.^[31]

Diavol can delete shadow copies using the IVssBackupComponents COM object to call the DeleteSnapshots method.^[32]

EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.^[33][34]

FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.^[31][35]

H1N1 disable recovery options and deletes shadow copies from the victim.^[36]

HELLOKITTY can delete volume shadow copies on compromised hosts.^[31]

HermeticWiper can disable the VSS service on a compromised host using the service control manager.^[37][38][39]

INC Ransomware can delete volume shadow copy backups from victim machines.^[40]

InvisiMole can can remove all system restore points.^[41]

JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.^[42]

Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.^[43][44]

MegaCortex has deleted volume shadow copies using vssadmin.exe.^[45]

Meteor can use bcdedit to delete different boot identifiers on a compromised host; it can also use vssadmin.exe delete shadows /all /quiet and C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete.^[46]

MultiLayer Wiper wipes the boot sector of infected systems to inhibit system recovery.^[14]

Netwalker can delete the infected system's Shadow Volumes to prevent recovery.^[47][48]

Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.^[1]

Playcrypt can use AlphaVSS to delete shadow copies.^[49]

Prestige can delete the backup catalog from the target system using: c:\Windows\System32\wbadmin.exe delete catalog -quiet and can also delete volume shadow copies using: \Windows\System32\vssadmin.exe delete shadows /all /quiet.^[50]

ProLock can use vssadmin.exe to remove volume shadow copies.^[51]

Pysa has the functionality to delete shadow copies.^[52]

Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.^[53]

REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.^{[54][55][56][57][58][59][60][61][62]}

ROADSWEEP has the ability to disable SystemRestore and Volume Shadow Copies.^[63][64]

RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.^[65]

Royal can delete shadow copy backups with vssadmin.exe using the command delete shadows /all /quiet.^[66][67][68]

Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.^[69]

Sandworm Team uses Prestige to delete the backup catalog from the target system using: C:\Windows\System32\wbadmin.exe delete catalog -quiet and to delete volume shadow copies using: C:\Windows\System32\vssadmin.exe delete shadows /all /quiet. ^[50]

WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.^[70][2][71]

WastedLocker can delete shadow volumes.^[72][73][74]

Wizard Spider has used WMIC and vssadmin to manually delete volume shadow copies. Wizard Spider has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.^[75]

Consider implementing IT disaster recovery plans that contain procedures for taking regular data backups that can be used to restore organizational data.^[76] Ensure backups are stored off system and is protected from common methods adversaries may use to gain access and destroy the backups to prevent recovery. In cloud environments, enable versioning on storage objects where possible, and copy backups to other accounts or regions to isolate them from the original copies.^[77]

Consider using application control configured to block execution of utilities such as diskshadow.exe that may not be required for a given system or network to prevent potential misuse by adversaries.

Consider technical controls to prevent the disabling of services or deletion of files involved in system recovery. Additionally, ensure that WinRE is enabled using the following command: reagentc /enable.^[78]

Limit the user accounts that have access to backups to only those required. In AWS environments, consider using Service Control Policies to restrict API calls to delete backups, snapshots, and images.