🎯 Shadow copy deletion

The items that name it 4

• Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack | Huntress
  writeup2026-10-06

  powershell.exe -Command Get-WmiObject Win32_Shadowcopy, Remove-WmiObject used to remove volume shadow copies, a common Akira action, concurrent with ransomware launch

• Plain Text Passwords: The Risks of Storing Them
  writeup2026-07-06

  Multiple administrative users executed commands to delete shadow copies across multiple hosts, detected by Huntress APAC SOC, indicative of ransomware pre-encryption behavior.

• Lateral Movement Attack: Techniques, Detection & Prevention
  writeup2026-07-01

  Ransomware precursor activity performed remotely to hinder recovery

• How the RaaS Business Model Actually Works
  article2026-07-01

  Observed as part of post-exploitation activity in the SonicWall-to-Akira incident, typically to hinder recovery