Akira Ransomware Crashes After Failed EDR Evasion
▼ Summary
– A ransomware affiliate’s attempt to reboot a victim’s system into Safe Mode backfired, as the tactic prevented the Akira malware from encrypting files due to memory constraints.
– Initial access was gained via credential spraying against a SonicWall SSL VPN lacking multifactor authentication, followed by RDP access to the domain controller and Active Directory enumeration.
– The attacker exfiltrated files to cloud storage using s5cmd before encryption, a classic double extortion strategy.
– Safe Mode booting, a known MITRE ATT&CK technique, disabled security tools like the Huntress agent and Defender, but caused “Out of Virtual Memory” errors that halted the ransomware payload.
– Huntress warns this failure may be situational, as more memory or retooled malware could enable future attacks, urging organizations to implement stronger defenses.
A ransomware affiliate’s attempt to blind security defenses by forcing a victim’s system into Safe Mode ended in failure, as the reboot inadvertently crippled the encryption process itself, according to new findings from Huntress.
In a technical analysis published on August 12, the managed security provider detailed an incident from early August in which an Akira ransomware affiliate breached a corporate network. The initial foothold came through a credential spraying attack against a SonicWall SSL VPN appliance that lacked multifactor authentication (MFA), a gap that allowed the attacker to gain entry with stolen credentials.
From there, the threat actor pivoted to the domain controller using Remote Desktop Protocol (RDP) and conducted Active Directory (AD) enumeration, a pattern consistent with prior Akira campaigns, Huntress noted. The intruder then moved laterally to an application server, where they collected sensitive files and exfiltrated them to cloud storage via s5cmd, a high-speed S3 transfer tool.
“This is classic double extortion activity: steal all the victims’ files before encrypting them, so if the victim doesn’t pay the ransom, they can threaten to post them on some sketchy underground forum or a darknet leak site,” Huntress stated.
The operation, however, took an unusual turn. Instead of deploying the ransomware payload directly, the attacker executed msconfig.exe and scheduled a reboot into “Safe Mode with Networking.” This tactic, listed by MITRE ATT&CK as T1688 (“Impair Defences: Safe Mode Boot”), has been used by groups like Snatch and AvosLocker for years, though it had not previously been observed in Akira intrusions.
“In Safe Mode, third-party services, including the Huntress agent, don’t start,” the report explained. “Defender real-time protection was down too. For the entire Safe Mode window, the host had no working EDR, and AV was blinded.”
But the strategy backfired spectacularly. Safe Mode boots into a minimal environment with constrained virtual memory, and the Akira process tree apparently exhausted available resources. The system threw an “Out of Virtual Memory” error, triggering a cascade of PowerShell hard errors precisely when the payload attempted to execute.
“The takeaway is a little uncomfortable. While Safe Mode blinded our controls, it may also have prevented the encryption it was meant to enable. That’s a lucky side effect of the attacker’s own mistake in these circumstances, not a defence you can plan around,” Huntress said.
The firm cautioned that this outcome is far from guaranteed in future attacks. “Ultimately, this could be a case of winning the battle, but not the war. It’s possible that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode,” the researchers wrote. “Akira’s developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion.”
Given that uncertainty, Huntress urged organizations to adopt a proactive security posture. The report’s recommendations emphasize hardening VPN access with MFA, monitoring for RDP abuse, restricting administrative privileges, and maintaining robust endpoint visibility even when attackers attempt to disable security tools.
(Source: Infosecurity Magazine)
