LCRYX Ransomware BCDEdit Shadow Copy and Boot Recovery Destruction

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects a sequence of actions often performed by the LCRYX ransomware, characterized by the suppression of Windows boot recovery settings via BCDEdit followed by the deletion of volume shadow copies (using vssadmin or wmic) or backup catalogs (using wbadmin), all executed from the same process within a 10-minute window.