This incident involves an Akira ransomware affiliate gaining initial access through credential spraying against an exposed SonicWall VPN without multi-factor authentication. Following domain controller compromise, the attacker enumerated Active Directory and exfiltrated data using WinRAR and s5cmd to cloud storage. To evade endpoint detection and response (EDR) and antivirus tools, the attacker rebooted the victim system into Safe Mode with Networking, effectively disabling security software. AnyDesk was deployed as a persistent remote access tool. However, the ransomware payload failed to execute encryption due to out-of-virtual-memory errors in Safe Mode. Despite the encryption failure, the attacker successfully exfiltrated credentials and file shares, enabling double extortion via data leak threats. This represents the first observed use of Safe Mode reboot as an anti-EDR evasion technique by Akira ransomware affiliates.

The attacker gained unauthorized access to the victim network, compromised the domain controller, and exfiltrated sensitive credentials and data. Although ransomware encryption failed due to Safe Mode limitations, the attacker retained the ability to extort the victim through threats of data leakage. The evasion technique of rebooting into Safe Mode disabled security protections, complicating detection and response efforts.

No official patch or fix applies as this is an attack technique rather than a software vulnerability. Organizations should enforce multi-factor authentication on VPN access to prevent credential spraying attacks. Monitoring for unusual reboots into Safe Mode and unauthorized installation of remote access tools like AnyDesk can aid detection. Strengthening credential hygiene and limiting exposure of VPN services are recommended. Since this is a novel evasion technique, defenders should update detection and response strategies accordingly.