VSSAdmin abuse is allowing attackers to turn a legitimate Windows recovery tool against compromised organisations. Huntress observed intruders creating shadow copies to extract the NTDS.dit Active Directory database, before deleting recovery copies to obstruct restoration.
The activity, reported on 15 September 2026, illustrates how credential theft and recovery disruption can be linked within the same intrusion. The technique is particularly relevant to organisations running Windows domain controllers, including small and medium-sized businesses.
How the VSSAdmin abuse was discovered
Huntress identified the pattern while investigating suspicious Volume Shadow Copy Service activity on a Windows domain controller. The investigation found that the attackers were not simply deleting shadow copies, a behaviour commonly associated with ransomware incidents.
Instead, the threat actors first used Windows shadow-copy functionality to make protected Active Directory data accessible. They could then copy the NTDS.dit database from the shadow copy before removing recovery copies from the affected system.
NTDS.dit is the database used by Active Directory Domain Services. It contains directory information about users, groups and computers, as well as credential-related data that can help attackers compromise domain accounts and expand their access across a network.
The observed sequence connected several potentially malicious objectives. These included accessing protected files, collecting domain credential data, supporting lateral movement and reducing the organisation’s ability to recover locally after destructive activity or ransomware.
The report does not identify a particular Windows release, build number or software version as vulnerable. This is not presented as a newly discovered product flaw or CVE. It is an abuse of legitimate administrative capabilities available in Windows environments, requiring defenders to judge the commands by their context and sequence.
How VSSAdmin abuse exposes NTDS.dit
Windows normally protects NTDS.dit because it is actively used by the domain controller. Directly copying the live database is therefore more difficult than copying an ordinary file. Volume Shadow Copy Service can create a point-in-time snapshot of a volume, giving an attacker another route to the protected database.
VSSAdmin is a built-in command-line utility for managing these shadow copies. Administrators, backup products and remote management tools may legitimately use related functions, which means the presence of VSSAdmin alone does not prove that an intrusion is taking place.
In the activity reviewed by Huntress, the important indicator was the chain of actions. A shadow copy was created on a domain controller, NTDS.dit became available for extraction, and shadow copies were subsequently removed. Taken together, these actions present a much stronger warning than any isolated command.
Why attackers create a shadow copy first
The creation stage gives the intruder a snapshot containing files that would otherwise be locked or protected. From that snapshot, the attacker can attempt to extract NTDS.dit and obtain Active Directory information for offline analysis.
Successful access to credential material can enable further account compromise. Because a domain controller is central to authentication, stolen data may help an attacker move from a single compromised system towards broader control of the Windows domain.
Why attackers delete the copies afterwards
After extracting data, the same Windows recovery mechanism can be used destructively. Deleting shadow copies removes local restore points that might otherwise help administrators recover files or roll systems back following ransomware or another disruptive event.
This final stage of VSSAdmin abuse can also make incident investigation harder by removing snapshots that may contain useful evidence. Huntress noted that attackers can combine shadow-copy creation and deletion, rather than relying on deletion alone.
- A shadow copy is created on the Windows domain controller.
- The snapshot provides access to protected Active Directory data.
- NTDS.dit is copied for potential credential theft and offline analysis.
- Shadow copies are deleted to reduce local recovery options.
- The stolen information may support lateral movement or later attack stages.
Current VSSAdmin abuse and exploitation status
Huntress reported observing the technique during an investigation, confirming that this is operational attacker behaviour rather than a purely theoretical scenario. However, the available report does not name a threat group, specify the number of affected organisations or identify a particular ransomware operation.
No software patch is associated with this event because the attackers are using intended Windows functionality. The report also does not describe a security update, fixed version or vendor mitigation that would disable the technique without affecting legitimate administration and backup operations.
The current risk therefore depends on whether an attacker has already gained sufficient access to run administrative commands on a domain controller. VSSAdmin abuse should be treated as a possible sign of an advanced intrusion, particularly when shadow-copy creation is followed by access to NTDS.dit or broad deletion of recovery copies.
Why this Active Directory attack matters
The incident joins two serious consequences in one sequence. Extracting NTDS.dit threatens the confidentiality of domain credentials, while deleting shadow copies threatens system availability and recovery.
This combination can leave an organisation dealing with both an identity compromise and limited rollback options. Businesses that depend on local shadow copies as their principal recovery method may be especially exposed if an attacker can reach a domain controller with administrative privileges.
What organisations should monitor and protect
Defenders should establish which systems and tools are authorised to create or delete shadow copies. Monitoring should focus on unexpected VSSAdmin execution on domain controllers, especially outside approved backup or maintenance activity.
- Alert on unusual creation or deletion of shadow copies on domain controllers.
- Investigate VSSAdmin commands alongside the initiating account, process and remote session.
- Monitor for attempts to locate, access or copy NTDS.dit from snapshots or unusual paths.
- Correlate shadow-copy activity with authentication anomalies and lateral movement.
- Keep recovery data off-host or immutable so a compromised administrator cannot remove every usable copy.
Any matching activity should prompt an investigation of the wider sequence, not only the individual command. If NTDS.dit may have been extracted, organisations should assess potential domain credential exposure while preserving evidence and validating independent backups.
Originally reported by Unknown.
