The Gentlemen RaaS: Mass Document Encryption with Shadow Copy Deletion (T1486)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•2

Detects potential ransomware activity characterized by a high volume of file modifications (create, write, rename) involving common document/data extensions, combined with the execution of commands designed to inhibit system recovery (shadow copy deletion, BCD modifications) or perform network share enumeration within the same timeframe and on the same host.