Akira ransomware fails in Safe Mode but data theft follows

An Akira ransomware affiliate thought they'd found a clever way to disable a victim's security tools: reboot the machine into Safe Mode, where most third-party software doesn't run. It worked — but the ploy backfired when the constrained environment also broke the ransomware's encryptor, leaving the victim's files untouched. The incident, detailed in a Wednesday blog post by security operations analyst James Northey at Huntress, offers a rare glimpse into the cat-and-mouse game between attackers and defenders, but Northey is quick to caution that the outcome was more luck than strategy.

Safe Mode trick backfires

About three hours into the intrusion, the attacker forced the computer to reboot into Safe Mode with Networking, a boot mode that only loads essential drivers and services, blocking most third-party software. Attackers, especially ransomware gangs, do this to disable endpoint detection and response products and other security tools that would otherwise detect and stop their malware from infecting victims' machines. While some ransomware crews, including Snatch and AvosLocker, have abused Safe Mode for this purpose for years, Huntress has never seen Akira do it until now.

In this case, the reboot stopped the Huntress agent and disabled Microsoft Defender's real-time protection, preventing Defender from quarantining the malicious file. "The attacker got their blind window," Northey wrote. "What they didn't get was a clean detonation." The gamble failed when the limited startup mode also broke the encryptor — the malicious program crashed, and the victim's files were never locked.

Victim dodges encryption, but data already stolen

But the ending wasn't entirely happy for the victim. The attacker had already stolen credentials and data from file shares before Safe Mode prevented the ransomware from doing its job. The attacker had moved to the application server to start collecting stolen data, downloading WinRAR and using that tool to archive mapped file shares before sending the stolen data to cloud storage using s5cmd, a fast S3 transfer utility. They also installed remote desktop software AnyDesk, configured to start with Windows, and abused this legitimate tool as a remote-access trojan, giving the attacker hands-on keyboard control. They also used it as a command-and-control channel to drop more malware, including the very cleverly named akira.exe ransomware binary — because no one would guess what that executable could be, right?

Northey explained the failure in technical terms, noting that Safe Mode boots with constrained virtual memory, and the computer started spewing memory errors thirteen seconds after the reboot. "Ultimately this could be a case of winning the battle, but not the war," Northey said on Wednesday in a blog shared with The Register. "It's possible that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode," Northey added. "Akira's developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion."

How the intrusion began

In early August, Huntress responded to an incident that began, as most Akira intrusions do, with a SonicWall SSL VPN. On August 4, the VPN logged a credential-spray attack: a burst of failed logins using bad credentials that it denied. But then, seven minutes later, one of them succeeded when the attacker used a valid VPN account that wasn't protected by MFA. Once they had gained access, the criminal accessed the domain controller via Remote Desktop Protocol (RDP) and queried Active Directory to hoover up detailed information about the network, users, groups, computers — essentially everything an attacker needs to know about who and what to target for lateral movement and mass encryption in a ransomware attack.

"The enumeration was a full-property dump of every user and every computer in the domain," Northey wrote.

"The attacker got their blind window. What they didn't get was a clean detonation."

— James Northey, security operations analyst at Huntress

Not a practical defense

Northey cautioned that this was more likely a memory-configuration issue, and shouldn't be taken as a practical defense to prevent Akira ransomware from locking up valuable files. The failure was specific to the memory constraints of Safe Mode on that particular host, not a reliable weakness in Akira's code. As Northey noted, a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode, and the developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion.

How to protect your organization

Nonetheless, there's one big lesson here: For the love of all that is holy, turn on multi-factor authentication (MFA). The VPN account that was used to gain entry wasn't protected by MFA, and that single missing control opened the door to the entire intrusion. In addition to the obvious recommendations — like make sure you receive alerts on bursts of failed VPN logins against multiple usernames from one source, and require MFA on every VPN account — Huntress suggests organizations keep an eye out for this Safe Mode play.

Specifically, "alert on boot-configuration changes and Safe Mode boots: msconfig.exe / bcdedit activity, Kernel-Boot EID 27 with a SAFEBOOT load option, Kernel-General EID 12 BootMode=2, and third-party security services stopping (System EID 7036)," Northey wrote. Also, "watch for tooling being added to the Safe Mode minimal-service registry list."

What this means for defenders

The incident highlights a growing trend: especially ransomware gangs are increasingly abusing Safe Mode to bypass security tools. While Akira had not been seen doing this before, the fact that they now have attempted it suggests that other groups may follow suit, or that Akira may refine their approach to avoid the memory issues that foiled them this time. For defenders, this means monitoring for Safe Mode reboots and boot-configuration changes could become an important part of detecting ransomware intrusions in their early stages. But the bigger lesson remains the same: MFA on VPN accounts is not optional, and data exfiltration can happen even when encryption fails. The victim in this case may have kept their files, but the attacker still walked away with stolen data — a reminder that ransomware is as much about data theft as it is about locking files.