Gunra shadow copy and backup deletion prior to encryption

Duo Tech@duotech

•updated Aug 11, 2026•3•0•13

Detects deletion of Volume Shadow Copies and backup catalogs (vssadmin, wbadmin, wmic shadowcopy, bcdedit) consistent with Gunra ransomware's pre-encryption recovery-inhibition behavior, requiring correlated multi-command deletion sequences to reduce noise from routine backup retention.