LCRYX Ransomware Shadow Copy and Backup Deletion to Inhibit Recovery

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects LCRYX ransomware and similar malicious activity involving the deletion of volume shadow copies, backup catalogs, and the disabling of system recovery features using standard Windows administrative utilities such as vssadmin, wbadmin, wmic, and bcdedit.