Akira Safe Mode attack disabled EDR, but encryption failed
Huntress says an Akira affiliate disabled endpoint security through Safe Mode, stole data, then hit a memory-related encryption failure.
By Dominic Okoye · Staff Writer
· 3 min read
An Akira Safe Mode attack disabled endpoint detection tools on a victim system before the ransomware payload failed to encrypt files, according to Huntress. The failure did not prevent data loss: the affiliate had already accessed credentials and copied data from file shares before the attempted encryption, Huntress analyst James Northey said in reporting by The Register.
Huntress said it was the first time it had observed an Akira affiliate use Windows Safe Mode for defense evasion. The incident shows a familiar ransomware sequence with an unusual final step: weak remote-access controls enabled entry, Safe Mode created a window without endpoint protection, and a configuration-dependent payload failure stopped the file-locking stage.
How did the Akira Safe Mode attack work?
According to Huntress, the intrusion began on Aug. 4 with a credential-spraying campaign against a SonicWall SSL VPN. The firewall logged failed attempts across multiple usernames at about 03:45 UTC; seven minutes later, a valid account without multifactor authentication was used to log in.
The operator waited nearly two hours, then used Remote Desktop Protocol to access the domain controller and enumerate Active Directory users and computers. Huntress reported that the attacker moved to an application server, installed WinRAR, compressed four mapped shares and transferred the resulting archives to an attacker-controlled S3 bucket with s5cmd.
Before the reboot, the affiliate installed AnyDesk as a service and added it to the Safe Boot registry list. That preserved remote access in Safe Mode with Networking, which loads a restricted set of Windows drivers and services while retaining network connectivity.
At 06:29:21 UTC, the attacker used msconfig.exe to force a restart. Huntress said its agent went offline, and Microsoft Defender real-time protection also stopped. Defender recorded error 0x8007043c, indicating that its service could not start in Safe Mode.
Why did encryption fail, and what should defenders do?
The same boot mode that removed endpoint defenses also appears to have constrained the ransomware. The Register reported that memory errors began 13 seconds after reboot, and Northey attributed the failed encryption to insufficient virtual memory in the Safe Mode environment.
That outcome is not a defensive control. Northey said a machine with more physical memory or a larger page file could give the encryptor enough memory to run. Akira developers or affiliates could also alter the payload to use less memory or operate more reliably in Safe Mode.
Security teams should treat a Safe Mode boot as a high-priority investigation signal when it follows suspicious remote access. Huntress recommended monitoring for:
- Bursts of failed VPN logins across accounts, followed by a successful login.
- Boot-configuration changes, including msconfig.exe or bcdedit activity.
- Kernel-Boot event ID 27 with a SAFEBOOT option and Kernel-General event ID 12 showing BootMode=2.
- Third-party security services stopping, including System event ID 7036.
- Programs added to Safe Mode's minimal-service registry list.
The CISA joint advisory on Akira says the group has affected businesses and critical-infrastructure organizations since March 2023. Its baseline guidance remains relevant here: remediate known exploited vulnerabilities, enforce phishing-resistant MFA, and maintain offline backups that have been tested for restoration.
This story draws on original reporting from SiliconANGLE.
