Off-topic for aiqbench
This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.
Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies
Windows attackers are turning a built-in recovery feature into a tool for disruption. By abusing Volume Shadow Copy Service, intruders can copy protected data, access the Active Directory database, and erase recovery copies after ransomware. The technique blends into Windows activity. Backup software, remote management tools, and administrators may create or remove shadow copies, forcing […] The post Hackers Abuse VSSAdmin to Extract NTDS.dit and Delete Windows Recovery Copies appeared first on Cyber Security News.
Windows attackers are turning a built-in recovery feature into a tool for disruption. By abusing Volume Shadow Copy Service, intruders can copy protected data, access the Active Directory database, and erase recovery copies after ransomware. The technique blends into Windows activity. Backup software, remote management tools, and administrators may create or remove shadow copies, forcing defenders to distinguish routine maintenance from a breach. The outcome is stolen domain credentials and fewer recovery options. Analysts at Huntress…
Excerpt shown under the publisher's RSS terms · 76 words · full text and figures are on the publisher's site
Related coverage
Silver Fox-Linked Hackers Use Fake Software Installers to Disable Microsoft Defender and Compromise Windows Systems
Cybersecurity News · Sep 2, 2026
Hackers Abuse Cloud Logging Services to Evade Detection and Defender’s Visibility
Cybersecurity News · Jun 17, 2026
Weekly Cyber Security Newsletter Bulletin – Entra ID RCE, Claude Code Ransomware, T-Mobile Cable, Azure Credential Theft +20 Stories
Cybersecurity News · Aug 23, 2026
Daily OT Security News: October 16, 2026
Viakoo · Oct 16, 2026