Akira ransomware attackers have been observed using a novel tactic to disable endpoint detection and response (EDR) solutions on compromised systems. According to a report by Huntress, a managed detection and response (MDR) services company, the attackers exploited an exposed SonicWall VPN device without multi-factor authentication (MFA) to gain initial access.
Attack Flow and Tactics
About two hours after gaining access, the attackers connected to the domain controller via RDP, enumerated Active Directory users and computers, and then moved to an application server. They used WinRAR to archive mapped file shares and the s5cmd command-line tool to upload the stolen data to an attacker-controlled S3 bucket, before installing AnyDesk for remote access.
The attackers then used AnyDesk to force the compromised host to boot into Safe Mode with Networking, which disabled both the Huntress agent and Microsoft Defender’s real-time protection. Safe Mode is a Windows startup state designed for troubleshooting and diagnostic operations, and it starts Windows with a limited set of drivers and services, generally preventing most third-party software and services from loading.
Exploiting Safe Mode for EDR Evasion
For 10 minutes while in Safe Mode, the host had no working EDR, and AV was blinded, according to Huntress. The attackers added AnyDesk to Windows’ Safe Mode registry, allowing it to start after reboot and retain their remote access to the breached machine. However, when they attempted to launch the main ransomware payload (akira.exe) via AnyDesk in Safe Mode, it failed to execute due to low virtual memory and generated out-of-memory and PowerShell errors.
A scheduled Defender scan eventually detected the Akira executable, even if real-time protection was disabled in Safe Mode, but the security tool could not remove it while the machine remained in that mode. Defender quarantined the file only after the attacker rebooted the system into normal mode, which restored real-time protection.
Impact and Recommendations
Despite the failure to encrypt files, the Akira operator still managed to steal credentials and files for data extortion, all in less than five hours from initial access. Huntress notes that other ransomware families, such as Snatch and AvosLocker, have used this tactic for years, but this incident marks the first time the company observed it in an Akira attack.
The researchers recommend adding MFA to all VPN accounts, placing credential-spraying detection measures, and monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry. Once attackers have valid credentials, only 37% of their actions are blocked, highlighting the importance of robust security measures.
- Key Takeaways:
- Akira ransomware attackers used Safe Mode to disable EDR solutions.
- The attack began with an exposed SonicWall VPN device without MFA.
- The attackers stole credentials and files for data extortion despite failing to encrypt files.
- Recommendations include adding MFA to VPN accounts and monitoring for Safe Mode boot configuration changes.
Overall prevention scores can hide what happens after initial access. Once attackers are using valid credentials, prevention drops sharply, as reported in The Blue Report 2026, which measures defenses technique by technique across 338 million simulations run in customer production environments.
Source: BleepingComputer