Akira Ransomware Affiliate Abuses Safe Mode to Evade EDR

In early August 2026, a Huntress-observed Akira ransomware affiliate executed a targeted attack against a victim environment. The threat actor initially gained access through an exposed SonicWall SSL VPN appliance lacking multi-factor authentication. Following successful authentication, the attacker pivoted to the domain controller, conducted extensive Active Directory reconnaissance, and staged data for exfiltration. In a notable attempt to bypass endpoint detection and response (EDR) solutions and Microsoft Defender, the attacker modified the host boot configuration to force a reboot into Safe Mode with Networking. This maneuver successfully disabled third-party security agents; however, it also deprived the Akira ransomware payload of the necessary resources, resulting in an out-of-memory failure that prevented file encryption. Despite the failure of the ransomware detonation, the attacker successfully exfiltrated sensitive data to an external S3 bucket prior to the reboot.

Attack Chain

1. Initial access is established by the threat actor using valid credentials via an exposed SonicWall SSL VPN appliance (T1190).
2. The attacker establishes remote persistent access using AnyDesk, identified by peer Client-ID 1778787240.
3. Reconnaissance is performed on Active Directory, with output files written to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt (T1087.002).
4. Data shares are discovered, collected, and compressed using WinRAR.exe (T1560.001).
5. Staged data is exfiltrated to an attacker-controlled S3 bucket using the s5cmd utility (T1567.002).
6. The attacker executes a command to modify boot configuration via msconfig.exe, setting the system to reboot into Safe Mode (T1562.001).
7. The system reboots into Safe Mode (EID 27: SAFEBOOT:NETWORK), which terminates EDR processes and disables Microsoft Defender real-time protection (T1547.001).
8. The Akira payload attempts to execute in the restricted environment, causing an out-of-virtual-memory crash, thereby failing to encrypt the host.

Impact

While the Akira ransomware encryption failed due to the host's transition into Safe Mode, the attacker successfully achieved data exfiltration. The loss of sensitive information exposes the organization to double-extortion tactics, where the actor threatens to publicly leak exfiltrated data unless a ransom is paid. The incident highlights a shifting landscape where ransomware affiliates are increasingly using environmental modification to evade automated security responses.

Recommendation

• Enable Sysmon or Windows Event Log auditing (Event ID 4697 or 7045) to detect modifications to the boot configuration via msconfig or BCDedit.
• Implement a policy to restrict VPN access to specific source IP addresses and enforce mandatory MFA for all VPN and remote access sessions.
• Deploy the provided Sigma rule to alert on unauthorized attempts to set the Windows boot mode to 'Safe Mode'.
• Monitor for the execution of file archival utilities like WinRAR.exe in non-standard directories or by non-admin accounts.
• Review network egress logs for unauthorized data movement to cloud storage providers (specifically S3) using utilities like s5cmd.exe.