Makop Ransomware - Backup Deletion Followed by Security Tool Termination

Ibrahim Saud@tektrix

•updated Jun 20, 2026•0•0•3

Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.