[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1490":3},{"item":4,"lessons":18,"controls":44,"related":73},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1490","T1490","Inhibit System Recovery",6,"MITRE","**What attackers do.** Attackers delete backups, shadow copies and recovery settings, or disable recovery services, so victims cannot restore systems without paying. This is a standard ransomware step and serves the Impact tactic.\n\n**How to defend.** Keep backups offline or immutable and separate from the main domain and its credentials. Restrict and monitor the use of tools that manage shadow copies, boot configuration and backup catalogues. Endpoint protection can block known commands used to delete recovery data. Alert on these actions with high priority, as they usually come shortly before encryption starts.\n\n**Signs to look for.** Look for deletion of shadow copies, changes to boot recovery settings, backup jobs being deleted or disabled and backup console logins from unusual hosts. A common gap is discovering backups were wiped only when a restore is attempted.","Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options.\n\nOperating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features. Adversaries may disable or delete system recovery features to augment the effects of Data Destruction and Data Encrypted for Impact. Furthermore, adversaries may disable recovery notifications, then corrupt backups.\n\nA number of native Windows utilities have been used by adversaries to disable or delete system recovery features:","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1490\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"ryuk-ransomware-operator-sentenced-lessons-for-ransomware-defense-1790245269589","Ryuk Ransomware Operator Sentenced: Lessons for Ransomware Defense","2026-09-24T10:21:09.356+00:00",{"slug":25,"title":26,"published_at":27},"settra-ransomware-abuses-rmm-tools-for-persistence-while-sabotaging-recovery","Settra Ransomware Abuses RMM Tools for Persistence While Sabotaging Recovery","2026-09-17T18:21:03.162+00:00",{"slug":29,"title":30,"published_at":31},"revstealer-modules-disable-windows-defender-and-update-to-deploy-crypto-miner","REVSTEALER Modules Disable Windows Defender and Update to Deploy Crypto Miner","2026-09-06T10:20:38.502+00:00",{"slug":33,"title":34,"published_at":35},"akira-affiliates-safe-mode-edr-bypass-backfires","Akira Affiliate's Safe Mode EDR Bypass Backfires","2026-08-13T12:20:21.153+00:00",{"slug":37,"title":38,"published_at":39},"genielocker-ransomware-targets-windows-linux-and-esxi-systems","GenieLocker Ransomware Targets Windows, Linux, and ESXi Systems","2026-07-30T10:21:23.435+00:00",{"slug":41,"title":42,"published_at":43},"gigawiper-modular-backdoor-merges-wiper-and-fake-ransomware-into-single-destructive-platform","GigaWiper: Modular Backdoor Merges Wiper and Fake Ransomware into Single Destructive Platform","2026-07-09T16:20:24.403+00:00",[45,50,55,59,64,69],{"slug":46,"name":47,"problem":48,"stories":49},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",5,{"slug":51,"name":52,"problem":53,"stories":54},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",3,{"slug":56,"name":57,"problem":58,"stories":54},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",{"slug":60,"name":61,"problem":62,"stories":63},"network-segmentation","Network segmentation and microsegmentation","One compromised machine can no longer reach everything else.",2,{"slug":65,"name":66,"problem":67,"stories":68},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",1,{"slug":70,"name":71,"problem":72,"stories":68},"network-detection-response","Network detection and response (NDR)","Attackers moving between systems inside the network get seen.",[74,79,84,89,94,98,102,106],{"family":75,"item":76,"code":77,"title":78,"together":9},"cis","10","Control 10","Malware Defenses",{"family":80,"item":81,"code":82,"title":83,"together":49},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":75,"item":85,"code":86,"title":87,"together":88},"11","Control 11","Data Recovery",4,{"family":90,"item":91,"code":92,"title":93,"together":54},"nist-sp","800-61","SP 800-61","SP 800-61 Rev. 3: Incident Response Recommendations and Considerations for Cybersecurity Risk Management",{"family":75,"item":95,"code":96,"title":97,"together":54},"13","Control 13","Network Monitoring and Defense",{"family":5,"item":99,"code":100,"title":101,"together":54},"t1486","T1486","Data Encrypted for Impact",{"family":103,"item":104,"code":105,"title":105,"together":54},"itil","overview","ITIL",{"family":75,"item":107,"code":108,"title":109,"together":63},"4","Control 4","Secure Configuration of Enterprise Assets and Software"]