Threats Tagged 'safe mode'

An Akira ransomware affiliate exploited an exposed SonicWall VPN lacking multi-factor authentication via credential spraying to gain initial access. After compromising the domain controller, the attacker performed Active Directory enumeration and exfiltrated data to cloud storage. The attacker used a novel evasion technique by rebooting the victim host into Safe Mode with Networking to disable EDR and antivirus protections. AnyDesk was installed for persistent remote access. The ransomware failed to encrypt files due to out-of-memory errors in Safe Mode, but the attacker had already exfiltrated sensitive credentials and data, enabling extortion through data leak threats. This is the first known use of Safe Mode reboot as an anti-EDR technique by Akira affiliates.