Akira exploits Safe Mode to bypass EDR defenses

In a recent incident, Akira ransomware affiliates employed a novel tactic to bypass endpoint detection and response (EDR) systems by rebooting a compromised Windows machine into Safe Mode with Networking. This move successfully took both Huntress's agent and Microsoft Defender's real-time protection offline, creating a window for the attackers to operate without endpoint defenses.

Attack Timeline Unfolds

The incident began on August 4 with a credential-spraying attack against an exposed SonicWall SSL VPN. Approximately seven minutes after the failed login attempts started, the attacker successfully authenticated to an account lacking multi-factor authentication (MFA). According to Huntress analyst James Northey, this breach of security paved the way for further exploitation.

Two hours later, the attacker accessed the domain controller via RDP, conducted extensive Active Directory enumeration, and moved to an application server to archive mapped file shares using WinRAR. The stolen data was then uploaded to an attacker-controlled S3 bucket using s5cmd, establishing the data-theft component of a double-extortion attack.

Safe Mode as an Evasion Technique

Ultimately, AnyDesk was installed on the host for persistent remote access and to deliver the Akira ransomware payload. Instead of directly disabling EDR, the operator used “msconfig.exe” to force the machine into Safe Mode with Networking. Huntress notes this is the first time it has observed Akira using this technique.

Safe Mode is a Windows troubleshooting environment that loads only essential drivers and services, making it useful for attackers because many third-party security products are excluded from the minimal startup configuration.

Adapting Safe Mode for Malicious Use

Anticipating that AnyDesk might also be unavailable in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start. This approach is not entirely new; Huntress points to ransomware families like Snatch and AvosLocker that have used Safe Mode to disable defenses for years. MITRE ATT&CK tracks this behavior as T1688, Impair Defenses: Safe Mode Boot.

Akira's Evolving Tactics

Akira adopting this technique aligns with its recent attempts to operate outside EDR coverage. Earlier this year, an Akira affiliate was reported creating a new virtual machine on a victim's hypervisor specifically to run the encryptor where Huntress was not installed.

Unintended Consequences

The technique, however, did not produce the outcome the attacker wanted. After “akira.exe” launched in Safe Mode, the system began reporting virtual memory failures. Huntress observed “Virtual Memory Minimum Too Low” and “Out of Virtual Memory” errors, followed by PowerShell failures. The ransomware apparently could not operate correctly within Safe Mode's constrained environment.

Defender eventually detected the Akira binary but could not remediate it while real-time protection was unavailable. The file was successfully quarantined only after the attacker rebooted the machine back into normal Windows operation, restoring Defender's protection.

Mitigation and Recommendations

Huntress cautions not to take the encryption failure too positively. The failure was likely a side effect of Akira's resource requirements rather than a dependable defense. More memory, a larger page file, or changes to the encryptor could allow a future version to work in Safe Mode.

The priority, therefore, remains detection before reboot. Huntress recommended organizations to require MFA on every VPN account, correlate bursts of failed VPN logins with subsequent successful authentication, and deploy EDR across all hosts. Huntress also advised monitoring SIEM feeds for “msconfig.exe” or “bccedit” activity, Safe Mode boot events, security service stopping, and additions to the Safe Boot registry configuration.

Implications for Defenders

This incident underscores a growing trend among ransomware groups to target EDR solutions directly. The use of Safe Mode to evade detection is a stark reminder that attackers are continuously adapting their methods. For organizations, the implications are clear: robust MFA enforcement, vigilant monitoring for anomalies like Safe Mode boots, and comprehensive EDR coverage are essential to mitigate such threats. As ransomware tactics evolve, defenders must stay one step ahead to protect critical systems and data.