Loading story…
Attackers are abusing Microsoft Volume Shadow Copy Service (VSS) to impair recovery ahead of ransomware deployment and to access copied NTDS.dIT data containing Active Directory credentials. In a Huntress investigation, PsExec-launched SYSTEM shells on a domain controller were followed by RDP-session enumeration, creation of VSS shadow copies, and an attempted deletion of the newly created copies; endpoint antivirus blocked the deletion attempt.
The activity also included DNS enumeration and reconnaissance against another host, supporting an assessment of lateral movement and credential-access operations. VSS creation or deletion alone is not a reliable alert because backup, RMM, and administrative products commonly use the service; defenders should correlate VSS events with process lineage, privileged remote execution, reconnaissance, credential harvesting, and event timing.
Get the actors, campaigns, and ATT&CK mapping behind it.
5 events from the most recent confirmed update back to the earliest known activity.
Several minutes after creating the shadow copies, the actor attempted to delete them. Endpoint antivirus blocked and flagged the deletion attempt.
DNS enumeration and reconnaissance against at least one additional host occurred in the same activity window, supporting the assessment of malicious lateral movement.
The actor ran a VSSAdmin command to create shadow copies following RDP-session enumeration. Huntress assessed the activity as consistent with an attempt to obtain credentials from an Active Directory NTDS.dit copy.
After launching the SYSTEM-level shells, the actor enumerated active Remote Desktop Protocol sessions on the domain controller.
In the described incident, PsExec spawned SYSTEM-level command-shell processes on a domain controller, indicating privileged remote execution.
Get the adversaries, campaigns, and ATT&CK mapping behind this technique, with detections ready to deploy.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors increasingly abused legitimate remote monitoring and management (RMM) software for initial access, persistence, credential theft, and defense evasion, with Huntress reporting that RMM abuse accounted for 24% of incidents it observed and surged 277% over the prior year. Campaigns used signed tools including **Action1**, **ScreenConnect**, **HeartbeatRM**, **AnyDesk**, **Atera**, and **SimpleHelp**, often chaining multiple products together to fragment telemetry and complicate containment. Delivery methods included phishing lures themed around the Social Security Administration and invitations, GitHub-hosted payloads, Cloudflare-protected sites, Windows-only filtering, and mobile-only credential harvesting pages; Huntress also observed low-maturity operators using LLM-generated scripts, VPS infrastructure, proxy tooling, combo lists, and utilities designed to hide RMM software from uninstall lists. Huntress also linked a sustained rise in compromises involving **Bomgar** instances to exploitation of **`CVE-2026-1731`**, a critical remote code execution flaw in BeyondTrust products, with attackers targeting outdated deployments to access victim networks and pivot into downstream customer environments. Reported incidents hit MSPs and software providers, including a ransomware attack affecting three downstream companies and another MSP breach that forced the isolation of 78 businesses while attackers moved into four customer environments. In affected networks, intruders created privileged accounts, added users to **Domain Admins**, ran reconnaissance with **NetScan** and **`nltest.exe`**, deployed suspicious drivers such as **PoisonX.sys** and **HRSword.exe**, and in several cases launched **LockBit** or a likely leaked-builder variant, underscoring the need to patch BeyondTrust systems, tightly govern trial and remote-access tooling, and monitor for unauthorized RMM activity.
Jun 29, 2026
Researchers reported a malware campaign using obfuscated **VBS** and **PowerShell** stages hosted across multiple DuckDNS domains to infect 64-bit Windows systems with a remote access trojan. The chain decrypts an **AES-256**-protected PowerShell stage, extracts a 64-bit payload, and uses a .NET helper to hollow `AppLaunch.exe` for stealthy execution. The malware then establishes persistence through the Windows Startup folder and attempts to weaken defenses by adding Microsoft Defender exclusions. The RAT communicates with suspected command-and-control infrastructure over port `4577` and is designed for credential theft and surveillance. Reported capabilities include stealing browser credentials and cookies, keylogging, clipboard capture, remote control, and local storage of stolen data, raising the risk of account takeover and broader compromise of enterprise sessions and sensitive information. The reporting includes hashes, filenames, domains, an IP address, and filesystem paths as indicators of compromise, with defenders urged to block the infrastructure, hunt for suspicious PowerShell activity, and isolate affected hosts.
Aug 10, 2026
Researchers reported that a **HelloXD ransomware** variant used a previously uncommon technique to delete Windows **Volume Shadow Copies (VSCs)** by interacting directly with the **Volume Shadow Copy Service (VSS) Coordinator** through **COM** objects. Unlike common approaches that invoke native tools such as `vssadmin` or `wmic`, or use WMI and PowerShell scripts, the sample abused Windows COM libraries in a way that resembles legitimate backup software, allowing it to remove all shadow copies and block restoration of prior file versions. VMware said the sample also used **`SeBackupPrivilege`** and COM **CLSIDs** tied to the VSS Coordinator, and noted that the method had little or no vendor detection at the time because it overlaps with normal backup activity. The company linked similar shadow-copy deletion behavior to multiple ransomware families, including **Conti, DarkGate, Diavol, Five Hands, BlackSun, Anchor, Somhoveran, MSILZilla,** and **Wana Decrypt0r 2.0**, while separate reporting tied the activity to a newer HelloXD variant that differed from earlier versions by lacking exfiltration features and a **MicroBackdoor** component. Researchers warned that organizations should not rely on VSCs alone for recovery and should maintain **offline backups** because deleted shadow copies are generally not recoverable.
Aug 15, 2026