Hits Safe Mode: Ransomware Rebooting Around EDR

An Akira ransomware affiliate gained initial access through an exposed SonicWall VPN without multi-factor authentication via credential spraying. After compromising the domain controller, the attacker performed Active Directory enumeration, collected and exfiltrated data using WinRAR and s5cmd to cloud storage. The affiliate employed a novel evasion technique by rebooting the victim host into Safe Mode with Networking to disable EDR and antivirus protection. AnyDesk was installed as a persistent remote access mechanism. However, the Safe Mode environment caused the ransomware to fail due to out-of-virtual-memory errors, preventing encryption. Despite the encryption failure, the attacker had already exfiltrated credentials and file shares, enabling extortion through data leak threats. This marks the first observed instance of Akira affiliates using Safe Mode boot as an anti-EDR technique.

• Maersk Confirms Data Theft Amid $5 Million Extortion AttemptBreach2026-11-12
• Who Runs the Ransomware Group Qilin?Threat Actor2026-11-11
• Citrus Ransomware: tactics, techniques, procedures, and links to Toy GhoulsMalware2026-11-11
• A New ESXi Implant Linked to Settra RansomwareMalware2026-11-10
• Key benefits of Zero Trust Network Access over corporate VPN access | Kaspersky official blogAnalysis2026-11-10