LCRYX Ransomware Shadow Copy and Backup Deletion to Prevent Recovery

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects the execution of Windows system recovery manipulation commands (vssadmin, wbadmin, or bcdedit) initiated by script interpreters (wscript.exe, cscript.exe). This pattern is commonly observed in malware and ransomware campaigns attempting to prevent system recovery.