Technique:  Inhibit System Recovery
Avaddon deletes backups and shadow copies using native system tools.
Babuk has the ability to delete shadow volumes using vssadmin.exe delete shadows /all /quiet.
BitPaymer attempts to remove the backup shadow files from the host using vssadmin.exe Delete Shadows /All /Quiet.
Black Basta can delete shadow copies using vssadmin.exe.
BlackCat can delete shadow copies using vssadmin.exe delete shadows /all /quiet and wmic.exe Shadowcopy Delete; it can also modify the boot loader using bcdedit /set {default} recoveryenabled No.
Clop can delete the shadow volumes with vssadmin Delete Shadows /all /quiet and can use bcdedit to disable recovery options.
Conficker resets system restore points and deletes backup files.
Conti can delete Windows Volume Shadow Copies using vssadmin.
DarkWatchman can delete shadow volumes using vssadmin.exe.
DEATHRANSOM can delete volume shadow copies on compromised hosts.
Diavol can delete shadow copies using the IVssBackupComponents COM object to call the DeleteSnapshots method.
EKANS removes backups of Volume Shadow Copies to disable any restoration capabilities.
FIVEHANDS has the ability to delete volume shadow copies on compromised hosts.
H1N1 disable recovery options and deletes shadow copies from the victim.
HELLOKITTY can delete volume shadow copies on compromised hosts.
HermeticWiper can disable the VSS service on a compromised host using the service control manager.
InvisiMole can can remove all system restore points.
JCry has been observed deleting shadow copies to ensure that data cannot be restored easily.
Maze has attempted to delete the shadow volumes of infected machines, once before and once after the encryption process.
MegaCortex has deleted volume shadow copies using vssadmin.exe.
Meteor can use bcdedit to delete different boot identifiers on a compromised host; it can also use vssadmin.exe delete shadows /all /quiet and C:\\Windows\\system32\\wbem\\wmic.exe shadowcopy delete.
Netwalker can delete the infected system's Shadow Volumes to prevent recovery.
Olympic Destroyer uses the native Windows utilities vssadmin, wbadmin, and bcdedit to delete and disable operating system recovery features such as the Windows backup catalog and Windows Automatic Repair.
Prestige can delete the backup catalog from the target system using: c:\Windows\System32\wbadmin.exe delete catalog -quiet and can also delete volume shadow copies using: \Windows\System32\vssadmin.exe delete shadows /all /quiet.
ProLock can use vssadmin.exe to remove volume shadow copies.
Pysa has the functionality to delete shadow copies.
Ragnar Locker can delete volume shadow copies using vssadmin delete shadows /all /quiet.
REvil can use vssadmin to delete volume shadow copies and bcdedit to disable recovery features.
RobbinHood deletes shadow copies to ensure that all the data cannot be restored easily.
Royal can delete shadow copy backups with vssadmin.exe using the command delete shadows /all /quiet.
Ryuk has used vssadmin Delete Shadows /all /quiet to to delete volume shadow copies and vssadmin resize shadowstorage to force deletion of shadow copies created by third-party applications.
WannaCry uses vssadmin, wbadmin, bcdedit, and wmic to delete and disable operating system recovery features.
WastedLocker can delete shadow volumes.
It has used WMIC and vssadmin to manually delete volume shadow copies. It has also used Conti ransomware to delete volume shadow copies automatically with the use of vssadmin.