🎯 Inhibit System Recovery

The items that name it 4

• Storm-3168: Agentic-driven cloud attacks using compromised service principals
  writeup2026-09-25

  Site Recovery disk locks and an Azure Backup protection lock were targeted for deletion.

• Huntress: How Attackers Abuse VSS, and How Huntress Detects It
  article2026-09-15

  Deleting shadow copies (e.g., via vssadmin) to prevent victim recovery before ransomware detonation

• MAJINAHANASHI RANSOMWARE: Yet Another Japanese Locker
  writeup2026-08-14It is written here as Inhibit System Recovery (T1490).

  Deletes volume shadow copies via vssadmin, deletes USN journal via fsutil, disables System Restore via WMI, changes boot configuration via bcdedit to disable recovery

• Socket: Operation Muck and Load
  writeup2026-07-16

  Listed capability signal in the payload chain.