Tool
vssadmin
- First Reported
- Sep 14, 2026
- Latest Reported
- Oct 9, 2026
Reported Context (2)
- It uses both vssadmin and wmic for this purpose: Dire Wolf Ransomware Disrupts Recovery and Encrypts Files Before Extorting Victims
- Huntress ransomware detections look at how the deletion occurred, not just that it occurred. VSSAdmin is the most common way to delete shadow copies, but it's not the only one, and detections must account for other Correlating VSS Activity Helps Detect Ransomware and Credential Theft
Malware (1)
People (2)
Threat Actors (1)
MITRE ATT&CK (12)
Vendors (3)
Products (5)
Tools (8)
Industries (5)
Countries (2)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.