Pay2Key Backup Deletion and Boot Recovery Disable via wbadmin and bcdedit

Ibrahim Saud@tektrix

•updated Jun 28, 2026•0•0•1

Detects the use of legitimate Windows tools (wbadmin.exe and bcdedit.exe) to inhibit system recovery by deleting backup catalogs or disabling automatic Windows recovery features. This behavior is commonly associated with ransomware strains like Pay2Key to ensure that backups cannot be used to restore encrypted data.