An Akira ransomware affiliate found a way to blind endpoint defenses on a compromised Windows host, but still could not get the encryption payload to run, according to managed detection and response firm Huntress.
The attack began on August 4 after the threat actor gained initial access through an exposed SonicWall VPN appliance that did not have multi-factor authentication enabled. Roughly two hours after logging in, the attacker connected to the domain controller via RDP, enumerated Active Directory users and computers, and pivoted to an application server.
From there, the operator used WinRAR to archive mapped file shares and the s5cmd command-line tool to exfiltrate the data to an attacker-controlled S3 bucket. They then installed AnyDesk to maintain remote access to the environment.
Safe Mode as an EDR killer
Using AnyDesk, the attacker forced the compromised machine to reboot into Safe Mode with Networking, a Windows troubleshooting state that loads only a limited set of drivers and services. This disabled both the Huntress agent and Microsoft Defender’s real-time protection for about 10 minutes, leaving the host without working EDR or antivirus coverage.
The attacker also added AnyDesk to the Safe Mode registry so it would keep launching after reboot, preserving their remote access. When they tried to run the main Akira ransomware executable (akira.exe) through AnyDesk while in Safe Mode, the payload failed to execute, throwing out-of-memory and PowerShell errors tied to low virtual memory.
A scheduled Defender scan later flagged the Akira binary even with real-time protection disabled, but could not quarantine it while the system remained in Safe Mode. The file was only removed after the attacker rebooted back into normal mode, which restored Defender’s real-time protection.
Despite the failed encryption attempt, the attacker still stole credentials and files for extortion purposes, completing the entire intrusion in under five hours from initial access.
A known tactic, new to Akira
Huntress notes that other ransomware operations, including Snatch and AvosLocker, have abused Safe Mode boots to evade security tooling for years, but this is the first time the technique has been observed in an Akira attack.
The researchers recommend enforcing MFA on all VPN accounts, deploying credential-spraying detection, and monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry.