Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender

An Akira ransomware affiliate has been observed rebooting a compromised Windows host into Safe Mode with Networking to disable endpoint protection an anti-EDR tactic linked to the operation.

The intrusion failed to encrypt files after the stripped-down boot environment triggered virtual-memory errors, but the actor had already stolen credentials and data, preserving leverage for a data-extortion attempt.

The case began with a credential spray against an exposed SonicWall SSL VPN. At 03:52 UTC, a valid account successfully authenticated to a VPN instance with no MFA.

Later, the operator used RDP to access the domain controller, launched an elevated command shell and began the reconnaissance pattern associated with Akira.

PowerShell commands dumped comprehensive Active Directory user and computer records into AdUsers.txt and AdComp.txt under ProgramData.

The user export contained user and credential-related data; the computer export provided host names, operating systems and IP addresses.

By setting $formatenumerationlimit to -1, the actor ensured multi-value attributes such as MemberOf were not truncated.

The operator then moved to an application server, downloaded WinRAR and recursively archived mapped file shares.

The archives were transferred with s5cmd to an attacker-controlled S3 bucket, a workflow consistent with double extortion: copy data first, then threaten disclosure regardless of whether encryption succeeds.

Huntress has previously detailed Akira activity exploiting SonicWall SSL VPN appliances and using clean virtual machines to avoid endpoint coverage.

Before execution, the affiliate installed AnyDesk as a Windows service, used it for delivery, and added the service to the SafeBoot Network registry key. At 06:29 UTC, msconfig.exe forced a reboot.

Akira Ransomware Reboots Windows

Windows telemetry recorded Kernel-Boot Event ID 27 with “SAFEBOOT:NETWORK” and Kernel-General Event ID 12 with BootMode=2.

The operator accessed the domain controller via Remote Desktop Protocol (RDP) and got hands-on: RDP’ing in, the attacker shortly spawned an elevated cmd.exe

Safe Mode with Networking starts essential Windows drivers and services while maintaining connectivity.

That design stopped the Huntress agent and prevented Microsoft Defender protection from starting; Defender logged Event ID 3002, “This service cannot be started in Safe Mode.”

The registry modification allowed AnyDesk to remain available despite the minimal boot configuration.

The behaviour maps to MITRE ATT&CK technique T1688, Impair Defences: Safe Mode Boot, historically associated with ransomware families including Snatch and AvosLocker.

The evasion step backfired. akira.exe started at 06:34 UTC, followed by a child-process burst. Windows logged “Virtual Memory Minimum Too Low” and “Out of Virtual Memory,” while PowerShell reported that a new stack guard page could not be created.

The evidence indicates that the ransomware process tree exhausted resources in Safe Mode before it could carry out encryption.

A scheduled Defender scan later detected the binary as Ransom:Win32/Akira.B!ibt, but cleanup failed while Safe Mode remained active.

Only after the attacker rebooted into normal Windows at 08:10 UTC did Defender’s restored real-time protection quarantine the file.

The incident is not a defensive success story. Safe Mode created a monitoring and prevention gap, and attackers may refine their payloads or target systems with more available memory.

Defenders should enforce MFA on VPN access, centralize SonicWall and Windows logs, investigate password sprays that precede successful logons, and alert on SafeBoot changes, Kernel-Boot Event ID 27, BootMode=2, security-service stoppages and new SafeBoot registry entries.

Organizations should also assume the Active Directory and file-share data collected before the failed detonation is compromised and rotate VPN and domain credentials.

IOCs

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now