Pay2Key Backup Catalog Deletion and Boot Recovery Inhibition

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•0

Detects the execution of Windows native utilities wbadmin.exe to delete system backup catalogs and bcdedit.exe to disable boot recovery features. This combination of commands is a hallmark of Pay2Key ransomware, used to inhibit victim system recovery following encryption.