Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies

Windows attackers are turning a built-in recovery feature into a tool for disruption. By abusing Volume Shadow Copy Service, intruders can copy protected data, access the Active Directory database, and erase recovery copies after ransomware.

The technique blends into Windows activity. Backup software, remote management tools, and administrators may create or remove shadow copies, forcing defenders to distinguish routine maintenance from a breach.

The outcome is stolen domain credentials and fewer recovery options. Analysts at Huntress identified this pattern while reviewing suspicious shadow-copy activity on a domain controller.

Their investigation showed how several linked actions can reveal an attempt to collect credentials, move through a network, and remove local recovery options before an attack reaches its final stage.

Huntress said in a report shared with Cyber Security News (CSN) that the threat actors do not rely on shadow-copy deletion alone.

They can create a shadow copy to obtain Active Directory data, then remove copies to reduce evidence and make rollback more difficult. This is a concern for organisations that treat backups as their only safeguard.

Hackers Abuse VSSAdmin

Volume Shadow Copy Service, or VSS, takes point-in-time copies of files and volumes. It supports backups and recovery, but also gives a privileged attacker a route around the normal lock on the Active Directory database, which stores account information and encrypted password material on a domain controller.

In the activity reviewed by researchers, PsExec launched command shells with SYSTEM-level permissions on a domain controller.

The intruder checked active Remote Desktop sessions and used VSSAdmin to create a shadow copy. This allowed a copy of the directory database to be taken from a static snapshot instead of reading it directly.

The approach can be quieter than extracting credentials from a live system. A stolen directory database can support offline recovery of password hashes and further access across a domain, as illustrated in this Active Directory database theft case.

The deletion stage removes a convenient local path to restore files. Reporting on ransomware recovery copy deletion shows that attackers use this tactic to narrow a victim’s recovery choices before encryption. Local snapshots should never be treated as the sole recovery plan.

Context Exposes the Intrusion

A shadow-copy event alone is a weak alert. Legitimate backup agents and remote monitoring tools often create or clear copies during scheduled work, so a rule that flags every VSS event can overwhelm responders and make genuine intrusions easier to miss.

The stronger signal is the surrounding chain. Huntress linked the suspicious creation event to SYSTEM-level remote execution, Remote Desktop session checks, credential-focused actions, DNS enumeration, and reconnaissance of at least one additional host.

Together, those events suggested lateral movement instead of an administrator running a cleanup task. That sequence matters because attackers often use valid tools after gaining access.

PsExec can run commands on remote systems under elevated permissions. Organisations can examine how it enables remote command lateral movement when deciding whether its use fits normal operational patterns.

Defenders should investigate VSS creation or deletion when it appears beside unusual remote execution, account activity, directory reconnaissance, or attempts to access sensitive files.

Process lineage, command history, user context, host role, and timing can establish whether a backup operation is expected or part of an intrusion.

The researchers recommend correlating events over a time window rather than judging one command in isolation. Teams should protect recovery copies with offline or separated backups, test restoration, limit privileged access to domain controllers, and review alerts combining VSS activity with credential harvesting or movement between hosts.

The lesson is straightforward: a shadow copy helps recovery, but it is not a security boundary. When attackers can create it, read it, and delete it with trusted Windows utilities, early detection depends on recognising the chain before stolen credentials and lost recovery options turn an incident into a domain-wide crisis.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Keep your SOC up to date on active malware & phishing within 24h of their emergence. Try ANYRUN to prevent incidents with early detection.

The post Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies appeared first on Cyber Security News.