MalwarePublished 13 Aug 2026

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

Source Bleeping Computer

ransomware

Description

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]

Impact

The attacker disabled endpoint detection and antivirus protections by rebooting into Safe Mode, allowing data theft and credential compromise without immediate detection or prevention. Although the ransomware payload failed to execute and encrypt files, the attacker exfiltrated sensitive data and credentials, enabling potential data extortion. The incident demonstrates a significant security bypass that reduces the effectiveness of EDR and antivirus solutions during Safe Mode, increasing risk of data breaches and persistent unauthorized access.

Defensive guidance

The vendor advisory and analysis recommend enforcing multi-factor authentication on all VPN accounts to prevent initial unauthorized access. Organizations should implement credential-spraying detection measures to identify brute-force attempts. Monitoring for unusual Safe Mode boot events and changes to the Safe Mode service registry, such as addition of remote access tools like AnyDesk, can help detect this evasion technique. Since Safe Mode disables many security agents, additional controls to restrict Safe Mode usage or alert on Safe Mode boots should be considered.

References

bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 13 Aug 2026, 21:26 UTC

References

Community reviews

Related threats