Pay2Key Ransomware - Backup Catalog Deletion and Boot Recovery Inhibition

Ibrahim Saud@tektrix

•updated Jun 27, 2026•1•0•1

Detects the execution of commands designed to inhibit system recovery or weaken system security settings. This includes deleting the Windows backup catalog via wbadmin, modifying boot configuration to disable automatic recovery via bcdedit, and disabling BitLocker protection using PowerShell.