Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA).
Intelligence analysis by Llama
Akira hackers used Safe Mode to disable EDR and steal data, but failed to encrypt files. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA).
Imagine a hacker getting into a computer system through a weak password. They then use a special tool to make the computer start up in a special mode called Safe Mode. In this mode, the computer's security system is turned off, and the hacker can steal data without being detected. However, the hacker's plan to encrypt the data fails because the computer's security system is still able to detect the ransomware even in Safe Mode.
Analysis
Akira Ransomware Attack Flow
The Akira ransomware attack flow was observed by Huntress, a managed detection and response (MDR) services company. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA).
The attacker connected to the domain controller via RDP, enumerated Active Directory users and computers, and then moved to an application server. They used WinRAR to archive mapped file shares and the s5cmd command-line tool to upload the stolen data to an attacker-controlled S3 bucket, before installing AnyDesk for remote access.
At that stage, the attacker used AnyDesk to force the compromised host to boot into Safe Mode with Networking and disable both the Huntress agent and Microsoft Defender’s real-time protection. Safe Mode is a Windows startup state designed for troubleshooting and diagnostic operations. It starts Windows with a limited set of drivers and services, generally preventing most third-party software and services from loading.
For 10 minutes while in Safe Mode, "the host had no working EDR, and AV was blinded," Huntress says. Meanwhile, the attackers added AnyDesk to Windows’ Safe Mode registry, allowing it to start after reboot and retain their remote access to the breached machine.
However, when they attempted to launch the main ransomware payload (akira.exe) via AnyDesk in Safe Mode, it failed to execute as the system reported low virtual memory and generated out-of-memory and PowerShell errors.
A scheduled Defender scan eventually detected the Akira executable, even if real-time protection was disabled in Safe Mode, but the security tool could not remove it while the machine remained in that mode. Defender quarantined the file only after the attacker rebooted the system into normal mode, which restored real-time protection.
Despite the failure to encrypt files, the Akira operator still managed to steal credentials and files for data extortion, all in less than five hours from initial access.
Huntress notes that other ransomware families, such as Snatch and AvosLocker, have used this tactic for years, but this incident marks the first time the company observed it in an Akira attack.
The researchers recommend adding MFA to all VPN accounts, placing credential-spraying detection measures, and monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry.
Prevention and Detection
Once attackers have valid credentials, only 37% of their actions are blocked. Overall prevention scores can hide what happens after initial access.
The Blue Report 2026 measures defenses technique by technique across 338 million simulations run in customer production environments.
Related Articles
Gentlemen ransomware uses multiple EDR killers to disable defenses Ransomware gang abuses Microsoft Teams relays to hide malicious traffic DeadLock ransomware uses blockchain to resist infrastructure takedown CISA: Microsoft SharePoint flaw now exploited in ransomware attacks US and South Korea warn of Gunra ransomware targeting govt agencies Akira AnyDesk EDR EDR Bypass Evasion Ransomware Safe Mode
Key points
- Akira hackers used Safe Mode to disable EDR and steal data, but failed to encrypt files.
- The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA).
- The attacker used AnyDesk to force the compromised host to boot into Safe Mode with Networking and disable both the Huntress agent and Microsoft Defender’s real-time protection.
- A scheduled Defender scan eventually detected the Akira executable, even if real-time protection was disabled in Safe Mode, but the security tool could not remove it while the machine remained in that mode.
- Huntress recommends adding MFA to all VPN accounts, placing credential-spraying detection measures, and monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry.
The fact that the Akira ransomware failed to encrypt files in Safe Mode suggests that the security system is still able to detect and prevent some types of attacks. This could be a positive development for cybersecurity, as it shows that some security measures are still effective even in the face of sophisticated attacks.
The fact that the hacker was still able to steal data and credentials in Safe Mode suggests that the security system is not foolproof. This could be a negative development for cybersecurity, as it shows that attackers are still able to find ways to bypass security measures and steal sensitive information.
