Akira ransomware disabled security tools but broke its own encryptor
Attacker's Safe Mode move bypassed defenses but also crippled their own malware functionality.
1Attack origin
In early August, the breach began via a SonicWall SSL VPN credential spraying attack. The hacker gained access within 7 minutes using a valid VPN account lacking MFA protection. Through Remote Desktop Protocol (RDP), they infiltrated the domain controller and harvested detailed information about all network users and computers via Active Directory enumeration.
2Data exfiltration
The attacker pivoted to an application server, using WinRAR to archive mapped file shares. They transferred stolen data to cloud storage via s5cmd, a fast S3 transfer utility. AnyDesk remote access software was installed as a RAT (Remote Access Trojan), while the akira.exe ransomware payload was deployed to the system.
3Safe Mode gambit
Three hours into the attack, the hacker force-rebooted the computer into Safe Mode with Networking, disabling Huntress agent and Microsoft Defender real-time protection. However, Safe Mode's constrained virtual memory settings backfired - the ransomware encryptor crashed due to insufficient memory, generating errors just 13 seconds after reboot.
4Memory constraints
Safe Mode blocks all non-essential drivers and third-party software, effectively neutralizing EDR solutions. But Akira's encryptor failed because it couldn't allocate sufficient virtual memory in this mode. Huntress analyst Northey noted systems with more physical memory might not exhibit this failure during encryption attempts.
5Security gaps exposed
The incident revealed risks from VPN accounts without MFA and lack of failed login attempt alerts. Organizations must monitor Safe Mode boots, boot configuration changes (msconfig.exe/bcdedit), and event logs like Kernel-Boot EID 27 to detect similar intrusion attempts.
6Industry parallels
Ransomware groups like Snatch and AvosLocker have weaponized Safe Mode for years to bypass security tools. However, Huntress observed Akira employing this technique for the first time. Attackers typically use this method to evade endpoint detection systems.
7Expected developer response
Experts anticipate Akira's developers may update the encryptor to reduce memory consumption or refine Safe Mode launch sequences. Such modifications could prevent similar failures in future attacks, making the ransomware more resilient against defensive measures.
8Key takeaways
The incident underscores the critical importance of multi-factor authentication (MFA). Organizations must enforce MFA on VPN accounts, enable failed login alerts, and monitor Safe Mode activity. As Northey warned, 'winning this battle doesn't mean the war is over' against evolving ransomware threats.