Harish Kumar 
A recent Akira ransomware intrusion took an unexpected turn when the threat actor’s own anti-detection trick appears to have sabotaged the attack.
According to researchers at Huntress, an Akira affiliate rebooted a compromised host into Safe Mode with Networking to disable endpoint defenses, only to watch the ransomware payload crash from an out-of-memory error before it could encrypt a single file.
The intrusion, observed in early August, followed Akira’s now-standard chain of compromise: initial access through an exposed SonicWall SSL VPN account with no MFA, lateral movement to the domain controller via RDP, and full Active Directory enumeration using PowerShell commands to dump every user and computer object into text files.
Akira Ransomware Uses Safe Mode to Bypass EDR
From there, the attacker installed WinRAR to archive mapped file shares and used the S3 transfer tool s5cmd to exfiltrate the data to cloud storage, tradecraft nearly identical to prior Akira campaigns tied to SonicWall exploitation.
What set this incident apart was the attacker’s use of AnyDesk, installed as a persistent service, to deliver commands and stage the ransomware binary.
Before triggering a reboot, the operator added a registry entry ensuring AnyDesk would still run in Safe Mode, then used msconfig.exe to force the host into Safe Mode with Networking, a diagnostic boot state that loads only essential drivers.
Safe Mode’s minimal driver set excludes most third-party security software by design, which meant the Huntress agent stopped running, and Microsoft Defender’s real-time protection failed to start, logging error 0x8007043c: “This service cannot be started in Safe Mode.”
This technique, tracked as MITRE ATT&CK T1688 (Impair Defenses: Safe Mode Boot), has been used for years by ransomware families like Snatch and AvosLocker, but this marks the first documented case of Akira adopting it.
Roughly five minutes after the Safe Mode reboot, the akira.exe process tree launched and immediately spawned child processes. Within seconds, Windows logged cascading “Out of Virtual Memory” errors and PowerShell stack-allocation failures.
Safe Mode’s constrained memory environment appears to have starved the ransomware before it could begin encrypting files, an unintended consequence of the very evasion technique meant to protect it.
Defender eventually flagged the binary as Ransom:Win32/Akira.B!ibt during a scheduled scan, but its cleanup routine failed repeatedly because real-time protection remained disabled.
Quarantine only succeeded after the attacker rebooted the host back to normal mode roughly two hours later, inadvertently restoring the defenses that finally removed the payload.
Despite the failed encryption, the attacker had already exfiltrated enough credentials, PII, and file shares to pursue extortion through a data-leak threat, even without locking down the network.
Huntress researchers caution that this outcome shouldn’t be mistaken for a reliable defense: a host with more RAM or a larger page file might have given the encryptor enough headroom to succeed, and Akira’s operators could easily retool the malware to reduce its memory footprint.
Organizations should enforce MFA on all VPN accounts, deploy EDR across all endpoints rather than a subset, and route VPN and Windows event logs to a SIEM to detect credential-spraying attempts early.
Security teams should also specifically alert on Safe Mode boot indicators, msconfig.exe activity, Kernel-Boot event ID 27 with SAFEBOOT parameters, and third-party services stopping unexpectedly, since this technique is likely to resurface in future Akira intrusions.
Site: Thecyberdef.com
Follow TheCyberDef on Google News, LinkedIn & X for the latest cybersecurity updates. Stay informed.
About the Author
Kiran 
