Akira hackers use Safe Mode to bypass EDR, steal data, skip encryption
▼ Summary
– An Akira ransomware affiliate disabled EDR and antivirus by rebooting a compromised host into Safe Mode with Networking, leaving it unprotected for 10 minutes.
– Initial access was gained on August 4 via an exposed SonicWall VPN device lacking multi-factor authentication, followed by RDP connection to the domain controller and Active Directory enumeration.
– The attacker exfiltrated data using WinRAR to archive mapped shares and s5cmd to upload to an S3 bucket, then installed AnyDesk for remote access.
– The ransomware payload (akira.exe) failed to execute in Safe Mode due to low virtual memory, but a scheduled Defender scan detected it; it was only quarantined after reboot into normal mode.
– Huntress notes this Safe Mode tactic has been used by other ransomware families like Snatch and AvosLocker, marking the first observed Akira case, and recommends MFA, credential-spraying detection, and monitoring for Safe Mode registry changes.
On August 4, an Akira ransomware affiliate successfully bypassed a victim’s endpoint detection and response (EDR) solution by rebooting a compromised machine into Safe Mode with Networking. The breach began when the attacker exploited an exposed SonicWall VPN appliance that lacked multi-factor authentication (MFA), according to managed detection and response (MDR) firm Huntress.
Within roughly two hours of the successful VPN login, the threat actor connected to the domain controller via RDP, mapped out Active Directory users and computers, and pivoted to an application server. Using WinRAR, they archived mapped file shares, then leveraged the s5cmd command-line utility to exfiltrate the data to an attacker-controlled S3 bucket. Afterward, they installed AnyDesk to maintain persistent remote access.
The next stage of the operation involved a clever maneuver: the attacker used AnyDesk to force the host into Safe Mode with Networking, disabling both the Huntress agent and Microsoft Defender’s real-time protection. Safe Mode, a Windows diagnostic startup state, loads only a minimal set of drivers and services, which typically prevents third-party security tools from running.
For a ten-minute window during Safe Mode, Huntress reports that “the host had no working EDR, and AV was blinded.” During that period, the attackers added AnyDesk to the Safe Mode registry, ensuring the remote access tool would launch after reboot and preserve their foothold.
However, the ransomware payload itself, akira.exe, failed to execute when launched via AnyDesk in Safe Mode. The system reported low virtual memory, generating out-of-memory and PowerShell errors that prevented encryption from proceeding.
Interestingly, a scheduled Defender scan later detected the Akira executable even though real-time protection was disabled in Safe Mode. The security tool could not remove the file while the machine remained in that state, but once the attacker rebooted into normal mode and real-time protection resumed, Defender successfully quarantined the malware.
Despite the encryption failure, the Akira operator still achieved their primary objective: credential theft and data exfiltration for extortion purposes. The entire operation, from initial access to data theft, unfolded in under five hours.
Huntress notes that other ransomware families, including Snatch and AvosLocker, have employed this Safe Mode tactic for years. However, this incident marks the first time the firm has observed it in an Akira attack specifically.
To mitigate such risks, Huntress recommends enforcing MFA across all VPN accounts, implementing detection measures for credential-spraying attempts, and monitoring for Safe Mode boot configuration changes or remote-access tools added to the Safe Mode service registry.
(Source: BleepingComputer)
