Huntress: Microsoft VSS has architectural limits and ransomware routinely deletes shadow copies
Huntress published a vendor blog post on the role and limits of Microsoft Volume Shadow Copy Service (VSS) in modern data protection. It explains that VSS remains a core framework for application-consistent snapshots on Windows workloads but should not be treated as a complete recovery or ransomware defense. The article warns that modern ransomware variants explicitly target and delete local VSS snapshots on execution. It recommends combining VSS with hardware-level providers, cloud-native recovery and immutable off-host backups. This is educational content with a product pitch, not a report on a specific incident.
Technical Details
- VSS is an orchestration framework with three components: the Requester (backup agent such as Azure Backup or Veeam), the Writer (application components in SQL Server, Exchange and Active Directory) and the Provider (software or hardware SAN).
- The snapshot cycle is request, prepare, freeze and flush, snapshot, thaw, and typically completes in under 60 seconds.
- VSS does not support volumes larger than 64TB. Attempting it produces errors such as 0x80042306 or system instability.
- The default software provider uses Copy-on-Write with a differential storage area, which adds write latency on write-heavy or NVMe-backed systems.
- VSS is Windows-specific, which creates visibility gaps in cross-platform, hybrid-cloud and containerized environments.
- ReFS Block Cloning is complementary: it clones files quickly through metadata but has no application Writer ecosystem. Modern backup suites often use VSS to freeze the application and then ReFS block cloning to create the copy.
Remediation
- Do not rely on local shadow copies as a ransomware defense.
- Keep off-site, immutable, off-host backups with defined retention policies and tested restore speeds.
- Use hardware-level or filesystem-native snapshotting for volumes above 64TB.
- Integrate VSS into a broader strategy that includes cloud-native recovery workflows.
- Monitor for attempts to delete shadow copies.
Linha do tempo
-
Huntress: Microsoft VSS has architectural limits and ransomware routinely deletes shadow copies
ler a análise desta fonte ocultar
Huntress published a vendor blog post on the role and limits of Microsoft Volume Shadow Copy Service (VSS) in modern data protection. It explains that VSS remains a core framework for application-consistent snapshots on Windows workloads but should not be treated as a complete recovery or ransomware defense. The article warns that modern ransomware variants explicitly target and delete local VSS snapshots on execution. It recommends combining VSS with hardware-level providers, cloud-native recovery and immutable off-host backups. This is educational content with a product pitch, not a report on a specific incident.
Technical Details
- VSS is an orchestration framework with three components: the Requester (backup agent such as Azure Backup or Veeam), the Writer (application components in SQL Server, Exchange and Active Directory) and the Provider (software or hardware SAN).
- The snapshot cycle is request, prepare, freeze and flush, snapshot, thaw, and typically completes in under 60 seconds.
- VSS does not support volumes larger than 64TB. Attempting it produces errors such as 0x80042306 or system instability.
- The default software provider uses Copy-on-Write with a differential storage area, which adds write latency on write-heavy or NVMe-backed systems.
- VSS is Windows-specific, which creates visibility gaps in cross-platform, hybrid-cloud and containerized environments.
- ReFS Block Cloning is complementary: it clones files quickly through metadata but has no application Writer ecosystem. Modern backup suites often use VSS to freeze the application and then ReFS block cloning to create the copy.
Remediation
- Do not rely on local shadow copies as a ransomware defense.
- Keep off-site, immutable, off-host backups with defined retention policies and tested restore speeds.
- Use hardware-level or filesystem-native snapshotting for volumes above 64TB.
- Integrate VSS into a broader strategy that includes cloud-native recovery workflows.
- Monitor for attempts to delete shadow copies.