The tactic disabled endpoint defenses as intended, but also accidentally broke the ransomware’s encryption process.
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled.
According to Huntress, the technique successfully took both its agent and Microsoft Defender’s real-time protection offline. This, the researchers said, gave the attacker a window to operate without endpoint defenses.
The incident investigated by Huntress began on August 4 with a credential-spraying attack against an exposed SonicWall SSL VPN. About seven minutes after the failed login attempts began, an attacker successfully authenticated to an account that did not have multi-factor authentication (MFA) enabled, Huntress analyst James Northey said in a blog post.
Two hours after authentication was managed, the operator reportedly accessed the domain controller over RDP, performed extensive Active Directory enumeration, and subsequently moved to an application server to archive mapped file shares with WinRAR.
The stolen data was uploaded to an attacker-controlled S3 bucket using s5cmd, establishing the data-theft component of a double-extortion attack.
Ultimately, AnyDesk was installed on the host machine for persistent remote access and to deliver the Akira ransomware payload. This is when the operator used “msconfig.exe” to force the machine into Safe Mode with Networking, instead of disabling EDR directly.
Huntress says this is the first time it has observed Akira using the technique.
Safe Mode is becoming a popular ransomware technique
Safe Mode is normally a Windows troubleshooting environment that loads only essential drivers and services. That makes it useful to attackers because many third-party security products are excluded from the minimal startup configuration.
Anticipating that AnyDesk itself might also be unavailable in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start.
The approach is not entirely new. Huntress pointed to ransomware families, including Snatch and AvosLocker, that have used Safe Mode to disable defenses for years. MITRE ATT&CK tracks the behaviour as T1688, impair Defenses: Safe Mode Boot.
Akira picking up the technique now aligns with its recent attempts to operate outside EDR coverage. Earlier this year, an Akira affiliate was reported creating a new virtual machine on a victim’s hypervisor specifically to run the encryptor where Huntress was not installed.
The anti-EDR move accidentally stopped the ransomware
The technique, however, did not produce the outcome the attacker wanted, Northey noted. After “akira.exe” launched in Safe Mode, the system began reporting virtual memory failures. Huntress observed “Virtual Memory Minimum Too Low” and “Out of Virtual Memory” errors, followed by PowerShell failures.
The ransomware apparently could not operate correctly within Safe Mode’s constrained environment.
Defender eventually detected the Akira binary, but could not remediate it while real-time protection was unavailable. The file was successfully quarantined only after the attacker rebooted the machine back into normal Windows operation, restoring Defender’s protection.
Huntress cautions not to take the encryption failure too positively. The failure, it said, was likely a side effect of Akira’s resource requirements rather than a dependable defense. More memory, a larger page file, or changes to the encryptor could allow a future version to work in Safe Mode.
The priority, therefore, remains detection before reboot. Huntress recommended organizations to require MFA on every VPN account, correlate bursts of failed VPN logins with subsequent successful authentication, and deploy EDR across all hosts. Huntress also advised monitoring SIEM feeds for “msconfig.exe” or “bccedit” activity, Safe Mode boot events, security service stopping, and additions to the Safe Boot registry configuration.