@huntress.com
Attackers abuse VSS to delete recovery copies or extract NTDS.dit; correlate activity with lateral movement and credential harvesting.
-
IOCs: vssadmin, PsExec, NTDS[.]dit
-
#CredentialAccess #Ransomware #ThreatIntel
Attackers abuse VSS to delete recovery copies or extract NTDS.dit; correlate activity with lateral movement and credential harvesting.
-
IOCs: vssadmin, PsExec, NTDS[.]dit
-
#CredentialAccess #Ransomware #ThreatIntel
VSS Abuse Enables Ransomware and Credential Theft
www.huntress.com
September 14, 2026 at 8:02 PM
@huntress.com
Attackers abuse VSS to delete recovery copies or extract NTDS.dit; correlate activity with lateral movement and credential harvesting.
-
IOCs: vssadmin, PsExec, NTDS[.]dit
-
#CredentialAccess #Ransomware #ThreatIntel
Attackers abuse VSS to delete recovery copies or extract NTDS.dit; correlate activity with lateral movement and credential harvesting.
-
IOCs: vssadmin, PsExec, NTDS[.]dit
-
#CredentialAccess #Ransomware #ThreatIntel