Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack

An Akira ransomware affiliate broke into a network via a SonicWall VPN account lacking MFA, moved laterally to the domain controller, exfiltrated Active Directory and file share data, then rebooted the compromised host into Windows Safe Mode with Networking to disable both an EDR agent and Microsoft Defender before launching the encryptor. The attacker had pre-configured AnyDesk to survive the reboot, but Safe Mode's constrained memory environment caused the akira.exe payload to crash with out-of-memory errors before encryption began. Defender later flagged the payload but couldn't quarantine it until the host was rebooted back to normal mode. Despite the failed encryption, exfiltrated data still left the victim exposed to extortion. Huntress, which disclosed the incident, warned the technique could become reliable on systems with more memory and recommended monitoring for Safe Mode reboots, msconfig/bcdedit activity, and enforcing MFA on VPN accounts.

Source: https://www.itsecurityguru.org/2026/08/13/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack. 8 Sync News only summarizes and links out; content copyright belongs to the authors and original sources.