The Akira ransomware affiliate gained initial access through a SonicWall VPN lacking multi-factor authentication. After accessing the domain controller and enumerating Active Directory, the attacker moved laterally to an application server, exfiltrated data using WinRAR and s5cmd to an attacker-controlled S3 bucket, and installed AnyDesk for remote access. The attacker then forced the compromised host to reboot into Safe Mode with Networking, which disables most third-party security software including EDR and real-time antivirus protection. AnyDesk was configured to run in Safe Mode to maintain access. During the 10 minutes in Safe Mode, the host had no effective endpoint protection. Attempts to run the Akira ransomware payload failed due to low virtual memory and PowerShell errors in Safe Mode. Defender eventually detected and quarantined the ransomware executable after the system rebooted to normal mode. Despite failure to encrypt files, the attacker successfully stole credentials and data for extortion within five hours of initial access. This is the first observed use of Safe Mode evasion by Akira ransomware, a tactic previously seen in other ransomware families.

The attacker disabled endpoint detection and antivirus protections by rebooting into Safe Mode, allowing data theft and credential compromise without immediate detection or prevention. Although the ransomware payload failed to execute and encrypt files, the attacker exfiltrated sensitive data and credentials, enabling potential data extortion. The incident demonstrates a significant security bypass that reduces the effectiveness of EDR and antivirus solutions during Safe Mode, increasing risk of data breaches and persistent unauthorized access.

The vendor advisory and analysis recommend enforcing multi-factor authentication on all VPN accounts to prevent initial unauthorized access. Organizations should implement credential-spraying detection measures to identify brute-force attempts. Monitoring for unusual Safe Mode boot events and changes to the Safe Mode service registry, such as addition of remote access tools like AnyDesk, can help detect this evasion technique. Since Safe Mode disables many security agents, additional controls to restrict Safe Mode usage or alert on Safe Mode boots should be considered. No official patch is applicable as this is a tactic rather than a software vulnerability.