Akira ransomware Safe Mode attempt disabled defenses but broke encryptor
A reported Akira intrusion used Safe Mode to suppress defenses, but memory limits stopped encryption after data theft had already occurred.
By Renata Fuchs · Policy Reporter
· 3 min read
An Akira ransomware Safe Mode attempt reportedly disabled endpoint defenses at an unnamed victim, then failed to encrypt the affected machine because the restricted boot mode left the malware short of virtual memory. The incident still produced a material breach: the attacker had already accessed credentials and exfiltrated data from file shares, according to Huntress findings reported by The Register.
Huntress security operations analyst James Northey described the early-August intrusion as an apparent Akira affiliate operation. The episode is a reminder that an encryptor failure is not the same as a contained incident. The alleged operator gained network access, mapped the environment and removed data before the final encryption stage malfunctioned.
How did the Akira ransomware Safe Mode attempt fail?
Huntress reported that the victim's SonicWall SSL VPN recorded a credential-spray attempt on August 4, with a burst of unsuccessful logins. Seven minutes later, a login succeeded using a valid VPN account that did not have multi-factor authentication enabled.
From there, the intruder reportedly used Remote Desktop Protocol to reach the domain controller and collected Active Directory information on users and computers. Huntress said the attacker later downloaded WinRAR to archive mapped file shares, transferred the archives to cloud storage using s5cmd, and installed AnyDesk for persistent remote access and command-and-control.
Roughly three hours after gaining entry, the operator forced a reboot into Safe Mode with Networking. The configuration starts Windows with only essential services and drivers, a feature ransomware operators can abuse to prevent third-party security products from starting. In this case, Huntress said its agent stopped and Microsoft Defender's real-time protection was disabled, leaving the malicious executable available to run.
Thirteen seconds after the restart, however, the endpoint began generating memory errors. Huntress attributed the failure to Safe Mode's constrained virtual-memory configuration, which apparently could not satisfy the Akira encryptor's requirements. The result was a failed encryption attempt on that endpoint, not a reversal of the credential and data theft that had already taken place.
What should security teams monitor after this incident?
Northey cautioned against treating Safe Mode as a defense against ransomware. A host with more physical memory or a larger page file could give the malware sufficient virtual memory, he said. Akira's operators or developers could also alter the encryptor to use less memory or make the Safe Mode launch more reliable.
Akira is described by Rubrik as a ransomware-as-a-service operation that combines file encryption with data theft. That model gives attackers leverage even when encryption does not complete, because stolen information can still be used in an extortion attempt.
Huntress recommended requiring MFA on every VPN account and alerting on failed VPN logins against multiple usernames from a single source. It also advised monitoring the following Windows activity:
msconfig.exeorbcdeditchanges to boot configuration;- Kernel-Boot Event ID 27 with a SAFEBOOT option;
- Kernel-General Event ID 12 showing
BootMode=2; - System Event ID 7036, which can record third-party security services stopping; and
- additions to the Safe Mode minimal-service registry list.
According to the report, Huntress had not previously observed Akira using Safe Mode in this way, though other ransomware crews have used the technique to suppress defenses.
This story draws on original reporting from The Register.
