Hackers Abuse VSSAdmin to Steal NTDS.dit, Delete Windows Backups

Key Takeaways

• Attackers are exploiting Windows’ native Volume Shadow Copy Service (VSS) to steal Active Directory credentials and remove backup recovery points.
• This technique allows threat actors to extract the NTDS.dit database, containing sensitive domain credentials, from a system snapshot.
• The abuse of VSSAdmin also facilitates the deletion of local shadow copies, hindering recovery efforts after ransomware or other destructive attacks.
• Detection requires correlating VSS activity with other suspicious behaviors like remote execution and reconnaissance, as VSS operations can appear legitimate in isolation.

Sophisticated Attackers Weaponize Windows’ VSS for Credential Theft and Backup Sabotage

Cybersecurity researchers have uncovered a concerning trend: attackers are actively leveraging the Windows Volume Shadow Copy Service (VSS) to gain unauthorized access to critical data and undermine system recovery capabilities. By manipulating this built-in feature, threat actors can covertly extract the Active Directory database (NTDS.dit), which houses valuable domain credentials, and subsequently eliminate crucial Windows recovery backups, leaving organizations vulnerable to further exploitation, including ransomware attacks.

The inherent challenge in detecting this attack vector lies in its blending with routine system operations. VSS is legitimately used by backup software, remote management tools, and administrators to create or remove shadow copies. This normalcy makes it difficult for security teams to differentiate between standard maintenance and malicious activity, creating a blind spot for potential breaches.

Analysts at Huntress identified this insidious pattern during an investigation into suspicious shadow-copy operations observed on a compromised domain controller. Their findings highlight a multi-stage attack methodology designed to steal domain credentials and impede recovery efforts before a full-scale assault, such as a ransomware deployment, reaches its final phase.

Huntress said in a report that attackers are not solely focused on deleting shadow copies to disrupt recovery. They strategically create a shadow copy to access Active Directory data, then delete these copies to obscure their tracks and complicate incident response. This dual-purpose abuse poses a significant risk to organizations that rely solely on local backups for their recovery strategy, underscoring the need for more robust and diversified backup solutions.

Hackers Abuse VSSAdmin

The Volume Shadow Copy Service (VSS) is a core Windows component designed to create point-in-time snapshots of files and volumes. While invaluable for backup and recovery, VSS also presents an opportunity for attackers with elevated privileges to bypass standard security measures protecting the Active Directory database. This database, NTDS.dit, contains crucial account information, including encrypted password hashes, on a domain controller.

In the incidents analyzed by researchers, attackers initiated command shells with SYSTEM-level permissions on a domain controller, often utilizing tools like PsExec. Following initial access, the intruders would typically enumerate active Remote Desktop sessions before employing VSSAdmin to generate a shadow copy. This crucial step allowed them to create a static snapshot of the directory database, enabling its extraction without directly interacting with the live, locked database—a far stealthier approach than attempting to dump credentials from a running system.

The successful exfiltration of the NTDS.dit file provides attackers with the means to perform offline password hash cracking. This offline process can yield cleartext credentials, facilitating further lateral movement and persistent access across the compromised domain. This method was clearly demonstrated in the Active Directory database theft case reviewed by the researchers.

The subsequent deletion of shadow copies serves a dual purpose: it removes forensic evidence of the malicious VSS activity and eliminates easily accessible local recovery points. This tactic is frequently observed in ransomware campaigns, where attackers aim to severely limit a victim’s options for restoring files before initiating encryption. Organizations must understand that local snapshots, while convenient, should never be the sole component of a comprehensive recovery strategy.

Context Exposes the Intrusion

Individual shadow-copy events, in isolation, often generate low-fidelity alerts. Legitimate backup agents and remote monitoring tools routinely create or delete VSS copies as part of their scheduled operations. Consequently, security rules that flag every VSS event risk overwhelming security teams with false positives, potentially allowing genuine intrusions to go unnoticed.

The true indicator of malicious activity lies in the contextual chain of events. Huntress’s analysis successfully correlated suspicious VSS creation and deletion with other critical indicators. These included SYSTEM-level remote code execution via PsExec, checks for active Remote Desktop sessions, actions focused on credential harvesting, DNS enumeration, and reconnaissance of additional hosts within the network. This aggregate of activities strongly indicated lateral movement and malicious intent, rather than an administrator performing routine maintenance. Attackers frequently leverage legitimate system utilities and tools, like PsExec, after gaining initial access to blend in with normal network traffic and avoid detection.

Organizations should meticulously examine instances where PsExec is used, particularly for remote command execution with elevated permissions. Understanding whether such usage aligns with established operational patterns is critical for identifying potential lateral movement.

Defenders should prioritize investigating VSS creation or deletion events when they occur alongside other suspicious activities, such as unusual remote execution, anomalous user account behavior, directory reconnaissance, or attempts to access sensitive files. Factors like process lineage, command history, the user context initiating the action, the role of the affected host, and the precise timing of events are crucial for determining whether a VSS operation is legitimate or indicative of an ongoing intrusion.

The researchers strongly advocate for correlating security events over a defined time window rather than evaluating individual commands in isolation. Furthermore, they recommend protecting recovery copies through offline or geographically separated backups, regularly testing restoration procedures, strictly limiting privileged access to domain controllers, and configuring alerts that combine VSS activity with other indicators of credential harvesting or lateral movement between hosts.

The fundamental takeaway is clear: while shadow copies are vital for data recovery, they do not constitute a security boundary. When attackers can manipulate VSS with trusted Windows utilities to create, access, and delete copies, early detection hinges on recognizing the broader attack chain before stolen credentials and destroyed recovery options escalate an incident into a full-scale domain compromise.

What You Should Do

• Implement Robust Backup Strategies: Ensure critical data, including Active Directory, is backed up to offline or immutable storage locations that are inaccessible to network-connected systems. Do not rely solely on local shadow copies for disaster recovery.
• Monitor VSS Activity with Context: Configure security monitoring to correlate VSS creation and deletion events with other suspicious activities such as remote code execution (e.g., PsExec), unusual account logins, directory enumeration, and attempts to access sensitive files.
• Limit Privileged Access: Enforce the principle of least privilege, especially for accounts with access to domain controllers. Restrict who can create, modify, or delete shadow copies.
• Review PsExec Usage: Regularly audit the use of tools like PsExec. Establish baselines for normal operational patterns and investigate any deviations that suggest unauthorized remote execution or lateral movement.
• Regularly Test Restoration: Conduct periodic tests of your backup and recovery procedures to ensure data integrity and the ability to restore systems effectively, even in scenarios where local shadow copies have been compromised.
• Enhance Endpoint Detection and Response (EDR): Utilize EDR solutions to gain visibility into process lineage, command line arguments, and user context, enabling better detection of VSS abuse and other attack techniques.
• Educate and Train Staff: Provide training to IT and security teams on recognizing the signs of VSS abuse and other common attack methodologies.

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.