{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/actors/clop/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":["CLOP"],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Windows"],"_cs_severities":["high"],"_cs_tags":["ransomware","impact","windows"],"_cs_type":"threat","_cs_vendors":["Microsoft"],"content_html":"\u003cp\u003eAdversaries, specifically those deploying ransomware families including CLOP, BlackByte, Medusa, and VanHelsing, frequently target Windows Volume Shadow Copy Service (VSS) to hinder incident response and data recovery. A primary technique involves using the built-in Windows utility 'vssadmin.exe' to resize or delete existing shadow storage volumes. By setting the maximum size of the shadow storage to a critically low value, attackers ensure that the operating system cannot maintain previous versions of files, effectively neutralizing the built-in recovery mechanism. This behavior is typically observed in the later stages of an intrusion, just prior to final file encryption and the deployment of a ransom note. Monitoring for the execution of vssadmin.exe with arguments related to resizing operations is critical for early detection of imminent ransomware impact.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eInitial access is established via phishing or exploitation of internet-facing vulnerabilities.\u003c/li\u003e\n\u003cli\u003eThe attacker performs lateral movement to gain elevated privileges (System/Administrator).\u003c/li\u003e\n\u003cli\u003eThe attacker executes discovery commands to identify backup mechanisms and shadow volume configurations.\u003c/li\u003e\n\u003cli\u003eThe attacker triggers a command-line process (cmd.exe, powershell.exe, or wmic.exe) to execute vssadmin.exe.\u003c/li\u003e\n\u003cli\u003eThe vssadmin command is executed with 'resize' and 'shadowstorage' parameters and the '/maxsize' flag to shrink the available storage.\u003c/li\u003e\n\u003cli\u003eThe operating system deletes or truncates existing shadow copies due to the new size constraint.\u003c/li\u003e\n\u003cli\u003eThe attacker proceeds to encrypt the file system, having successfully eliminated local recovery options.\u003c/li\u003e\n\u003cli\u003eA ransom note is displayed, and exfiltration of sensitive data occurs if not already completed.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful manipulation of shadow storage volumes significantly increases the impact of ransomware attacks. By eliminating the ability to restore files from Volume Shadow Copies, organizations are forced to rely on offline backups or pay the ransom to recover encrypted assets. This technique has been observed across multiple ransomware campaigns targeting enterprise environments, leading to prolonged downtime and the potential for irreversible data loss.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rule to monitor for suspicious process-creation events involving vssadmin.exe and volume resizing arguments.\u003c/li\u003e\n\u003cli\u003eEnable Sysmon (Event ID 1) or Windows Security Log (Event ID 4688) logging to capture detailed command-line arguments for all sensitive administrative utilities.\u003c/li\u003e\n\u003cli\u003eImplement an allow-list or monitoring policy for administrative tools used for disk/volume management to identify unauthorized usage in production environments.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-12T17:56:25Z","date_published":"2026-10-12T17:56:25Z","id":"https://feed.craftedsignal.io/briefs/2026-10-resize-shadowstorage/","summary":"Threat actors deploying ransomware such as CLOP, BlackByte, and Medusa manipulate Windows shadow storage volumes using vssadmin.exe to prevent data recovery.","title":"Detection of Shadow Storage Volume Manipulation via Vssadmin","url":"https://feed.craftedsignal.io/briefs/2026-10-resize-shadowstorage/"}],"language":"en","title":"CraftedSignal Threat Feed - CLOP","version":"https://jsonfeed.org/version/1.1"}