The Gentlemen Ransomware Shadow Copy and Backup Deletion T1490

Ibrahim Saud@tektrix

•updated Jun 30, 2026•5•0•11

Detects the use of native Windows administration utilities (vssadmin, wbadmin, bcdedit, wmic, powershell) to delete shadow copies, modify boot configurations to disable recovery, or remove backup catalogs, a behavior typically performed by ransomware groups like The Gentlemen to prevent system recovery.