Full research report

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

Original reporting ↗
★ Threat intelligence assessment high confidence

Executive assessment

This incident illustrates a deliberate tactical expansion by an Akira affiliate, adopting a Safe Mode EDR-bypass technique with documented precedent in Snatch and AvosLocker operations. The attack succeeded in its operationally decisive objective — data theft for double-extortion — within five hours, making the encryption failure a secondary concern from the adversary's perspective. The encryptor's failure was an unintended consequence of Safe Mode's resource constraints, not a defensive control; Huntress explicitly cautions against treating it as reliable protection. The SonicWall SSL VPN without MFA remains the singular preventable failure in this chain: credential spraying achieved access in seven minutes, underscoring that authentication hygiene is more consequential than any downstream detection control. Defenders should treat the SafeBoot registry key and SAFEBOOT boot-parameter monitoring as high-priority detection additions alongside VPN MFA enforcement.

What happened

On 4 August 2026 an Akira ransomware affiliate performed a credential-spray attack against an MFA-unprotected SonicWall SSL VPN, achieving a successful login within seven minutes. Over approximately two hours the attacker moved laterally to the domain controller via RDP, enumerated Active Directory, archived file-share data with WinRAR, and exfiltrated it to an attacker-controlled S3 bucket using the s5cmd utility. The operator then forced a Windows Safe Mode with Networking reboot via msconfig.exe to suppress the Huntress EDR agent and Microsoft Defender real-time protection, pre-registering AnyDesk in the SafeBoot registry to retain remote access. The Akira encryptor (akira.exe) failed to execute due to virtual memory exhaustion in the constrained Safe Mode environment; Defender detected and quarantined the payload only after the attacker rebooted to normal mode.

Affected scope

Organisations running SonicWall SSL VPN without enforced MFA are the primary entry-point risk. Any Windows environment where third-party EDR agents are not configured to persist through Safe Mode reboots is exposed to the EDR-blind window. Huntress reports this as the first observed use of the Safe Mode tactic by an Akira affiliate; the technique itself has been used by Snatch and AvosLocker in prior campaigns.

Technical assessment

The attacker triggered Safe Mode via msconfig.exe with the SAFEBOOT:NETWORK parameter, which loads only essential kernel drivers and suppresses most third-party services — including EDR agents not explicitly registered for Safe Mode operation. AnyDesk was pre-registered under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot to survive the reboot and retain C2 access. The Akira encryptor relies on concurrent worker threads and heavy memory-mapping for speed, a design that proved incompatible with Safe Mode's severely constrained virtual-memory environment, causing cascading out-of-memory and PowerShell allocation failures. Notably, even with real-time protection disabled, a scheduled Defender scan later detected the payload — though quarantine was only possible after normal-mode boot restored full driver support.

Recommended defensive actions

  1. Enforce MFA on all SonicWall SSL VPN accounts and all external-facing authentication portals to prevent credential-spray success.
  2. Configure EDR agents to load and operate in Windows Safe Mode, or deploy solutions that explicitly register under the SafeBoot control set.
  3. Monitor for msconfig.exe and bcdedit.exe execution and alert on Windows Kernel-Boot Event ID 27 containing 'SAFEBOOT' in the boot parameters.
  4. Alert on write events to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot registry keys, which indicate an attempt to persist processes or remote-access tools through Safe Mode reboots.
  5. Monitor VPN authentication logs for credential-spray patterns — multiple rapid failed logins from one or several IPs followed by a successful login — and trigger immediate investigation.
  6. Audit all endpoints for unauthorised remote-access tool installations such as AnyDesk and alert on new service registrations matching known RAT binaries.
  7. Rotate all Active Directory and VPN credentials immediately upon detection of any AD enumeration activity or unexplained VPN login.

Uncertainties and evidence gaps

  • The victim organisation and sector are not publicly identified; affected scope beyond this single incident is unknown.
  • Whether the credential-spray success exploited a specific SonicWall vulnerability or was purely an MFA-absence issue is not confirmed; Akira has previously abused named SonicWall CVEs but none are attributed here.
  • The full volume and sensitivity of data exfiltrated to the attacker-controlled S3 bucket have not been disclosed.
  • Whether Akira affiliates routinely test the encryptor in Safe Mode environments, or whether this failure reflects an operator oversight, is unknown.

Vulnerability flow

Defender-oriented path reconstructed only from sourced report findings. Unknown stages are omitted.

AccessExternal network access to a SonicWall SSL VPN portal with no MFA requirement; credential spraying sufficient for successful authentication within seven minutes.
ComponentSonicWall SSL VPN authentication boundary; Windows Safe Mode startup configuration; EDR agent service registration.
MechanismCredential spraying against an MFA-free VPN grants a valid authenticated session; subsequent lateral movement via RDP; Safe Mode reboot via msconfig.exe strips third-party security services from loading; attacker-controlled remote-access tool pre-registered in SafeBoot registry retains remote access through the reboot.
ImpactComplete loss of EDR visibility and real-time AV coverage during the Safe Mode window; Active Directory user database and file-share contents exfiltrated for double-extortion leverage; ransomware encryption failed due to Safe Mode memory constraints.
DetectionVPN logs showing credential-spray pattern; Windows Event ID 7036 (service stopped) for security agents during Safe Mode; Kernel-Boot Event ID 27 with SAFEBOOT parameter; registry write events to SafeBoot control key; unexpected AnyDesk process or service registration on endpoints.
MitigationEnforce MFA on SonicWall VPN; configure EDR for Safe Mode persistence; alert on SAFEBOOT boot-configuration changes and SafeBoot registry key modifications.
Exploitation status

No encryption achieved in this incident; data exfiltration confirmed. Initial access relied on credential spraying against an MFA-unprotected SonicWall SSL VPN, with no specific CVE attributed. Akira has historically exploited named SonicWall vulnerabilities in prior campaigns but none are confirmed for this attack.

Research process

The investigation opened with BleepingComputer reporting an Akira affiliate using Safe Mode to blind EDR, sourced from a Huntress incident response. Fetching the Huntress primary blog post provided a precise UTC timeline, full tool inventory, specific detection Event IDs, and registry-level persistence detail. The Register independently corroborated the incident and added analyst commentary explaining the structural reason for the encryptor's failure in a memory-constrained environment. Targeted searches confirmed Akira's established pattern of SonicWall VPN initial access and established that the Safe Mode technique predates Akira, having been used by Snatch since 2018 and AvosLocker more recently — contextualising this as a known tactic newly adopted by an Akira affiliate rather than a novel capability.

  1. What are the confirmed facts of the incident as reported by the primary outlet?
    Fetched the BleepingComputer article for initial event framing.
    bleepingcomputer.com ↗

    Attack on 4 August 2026 via SonicWall VPN without MFA; AD enumeration; WinRAR and s5cmd data exfiltration to attacker S3; Safe Mode reboot disabled EDR for ~10 minutes; akira.exe failed due to virtual memory errors; Defender quarantined payload after normal-mode reboot.

    why Established the event timeline and identified the Huntress incident report as the primary source requiring direct verification.

  2. What additional technical and timeline detail does the Huntress primary report contain?
    Fetched the Huntress blog post as the originating primary source.
    huntress.com ↗

    Precise UTC timestamps from 03:45 to 08:12; msconfig.exe SAFEBOOT:NETWORK mechanism; SafeBoot registry persistence for AnyDesk; specific WinRAR flags; s5cmd exfiltration; Kernel-Boot Event ID 27 and Service Event ID 7036 as detection signals; recommendation to monitor SafeBoot registry key writes.

    why Primary source confirmed BleepingComputer reporting and provided actionable defensive detail not available from secondary outlets.

  3. Does an independent source corroborate the incident and offer further analytical perspective?
    Fetched The Register's independent coverage of the same incident.
    theregister.com ↗

    Confirms timeline and tools; analyst James Northey explains that Akira's encryptor uses concurrent worker threads and heavy memory mapping for speed, a design that cannot function in Safe Mode's constrained environment; cautions against treating this failure as a reliable defence.

    why Provides independent corroboration from a second domain and explains the technical root cause of the encryption failure, distinguishing accidental defender success from intentional defensive capability.

  4. Has Akira historically used SonicWall devices for initial access, and are named CVEs associated with this pattern?
    Searched for Akira SonicWall CVE initial access history across 2024–2026.

    Akira has an established pattern of SonicWall SSL VPN exploitation including CVE-2024-40766 and a 2025 SMA100 campaign. This incident used credential spraying against an MFA-free device; no CVE is attributed in verified primary reporting.

    why Confirmed the broader Akira–SonicWall affinity but separated it from CVE exploitation in this specific case; MFA absence is the exploitable condition, not a software vulnerability.

  5. How established is the Safe Mode EDR-bypass technique, and which ransomware families have previously used it?
    Searched for Snatch and AvosLocker Safe Mode EDR bypass historical use.

    Snatch pioneered the technique circa 2018–2019; AvosLocker reused it circa 2022. Both documented by BleepingComputer and Sophos. Huntress explicitly states this is the first observed use by an Akira affiliate.

    why Contextualises the technique as mature and known to defenders, meaning existing detection rules may already exist; confirms Akira's adoption represents a tactical expansion rather than a novel capability.

Named in this story
ActorsAkira ransomware affiliate
Malwareakira.exeAnyDesk (abused for remote access and C2)WinRARs5cmd
TargetsUnidentified organisation running SonicWall SSL VPN without MFA

Research coverage

All 68 registered source leaves were evaluated for this run: 61 completed, 0 were unavailable, 0 failed and 7 were disabled. For this story, 3 registered sources supplied useful evidence (1 primary, 2 corroborating, 0 contextual and 0 PoC/exploit references). 58 completed sources contained no matched information for this story.

Primary evidence Independent corroboration Operational context PoC reference Checked — no match Unavailable Failed Disabled
Complete source-by-source audit 68 sources
SourceRun resultValueWhy it was useful — or not
BleepingComputernews ok11 records Primary evidence2 matched items Published the source report used to frame and date the event. Supplied independent analysis opened and verified during focused research.
CISA Alertsnews ok empty0 records Corroborating1 matched items A page from this source was opened and verified during focused research.
CISA KEVkev ok1665 records Corroborating1 matched items A page from this source was opened and verified during focused research.
AlienVault OTXdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
CIRCL CVEcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco PSIRTvendor_advisory ok5324 records Checked — no match The source completed, but none of its retained records matched this story.
Cisco Talosnews ok2 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI CVE most exploiteddeepdarkcti ok94 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Discorddeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI exploitsdeepdarkcti ok24 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI forumsdeepdarkcti ok264 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware as a servicedeepdarkcti ok7 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI malware samplesdeepdarkcti ok3 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI marketsdeepdarkcti ok127 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI phishingdeepdarkcti ok19 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI ransomware gangsdeepdarkcti ok682 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI RATsdeepdarkcti ok1 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram infostealerdeepdarkcti ok130 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Telegram threat actorsdeepdarkcti ok1008 records Checked — no match The source completed, but none of its retained records matched this story.
deepdarkCTI Twitter threat actorsdeepdarkcti ok39 records Checked — no match The source completed, but none of its retained records matched this story.
DNSDumpster domain IOC enrichmentresearch ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Exploit-DBexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
FIRST EPSSepss ok7640 records Checked — no match The source completed, but none of its retained records matched this story.
Fortinet PSIRTvendor_advisory disabled Disabled Disabled in the source registry; no check was attempted.
GitHub topic: cveresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: exploitresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: penetration-testingresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: pocresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GitHub topic: vulnerabilityresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
GreyNoiseexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
KrebsOnSecuritynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
LinkedIn RSS proxy feeds (disabled)research disabled Disabled Disabled in the source registry; no check was attempted.
MalwareBazaardark_web ok5 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cveresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #cybersecurityresearch ok12 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #exploitresearch ok17 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #infosecresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #malwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #ransomwareresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #threatintelresearch ok20 records Checked — no match The source completed, but none of its retained records matched this story.
Mastodon #vulnerabilityresearch ok18 records Checked — no match The source completed, but none of its retained records matched this story.
Metasploit module metadataexploit_reference ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft MSRCvendor_advisory ok1590 records Checked — no match The source completed, but none of its retained records matched this story.
Microsoft Securitynews ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP Galaxyresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
MISP threat actor galaxyactor ok0 records Checked — no match The source completed, but none of its retained records matched this story.
NVDcve ok900 records Checked — no match The source completed, but none of its retained records matched this story.
Palo Alto Networks PSIRTvendor_advisory ok25 records Checked — no match The source completed, but none of its retained records matched this story.
ProjectDiscovery nuclei templatesexploit_reference ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Rapid7news ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Reddit r/AskNetsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/cybersecurity (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/malware (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/netsec (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
Reddit r/ReverseEngineering (pending API approval)research disabled Disabled Disabled in the source registry; no check was attempted.
SANS ISCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Shadowserver public aggregate honeypot observationsexploit_reference ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Shodanresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
Sigma Rulesresearch ok2 records Checked — no match The source completed, but none of its retained records matched this story.
Sophos IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
The Hacker Newsnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
ThreatFoxthreat_intelligence ok100 records Checked — no match The source completed, but none of its retained records matched this story.
UK NCSCnews ok1 records Checked — no match The source completed, but none of its retained records matched this story.
Unit42 IOCsresearch ok empty0 records Checked — no match The source completed but returned no records in the collection scope.
URLhausdark_web ok10 records Checked — no match The source completed, but none of its retained records matched this story.
VirusTotal Community IOC enrichmentresearch ok4 records Checked — no match The source completed, but none of its retained records matched this story.
VulnCheck KEVkev ok500 records Checked — no match The source completed, but none of its retained records matched this story.
Vulnerability Lookupcve ok30 records Checked — no match The source completed, but none of its retained records matched this story.
Additional verified pages 2 opened outside the registered collection
References & evidence
Analysis & research3
Akira Hits Safe Mode: Ransomware Rebooting Around EDR huntress.com ↗

Primary incident report by Huntress with full UTC timeline, tool inventory, and actionable detection Event IDs.

Akira ransomware scum blocked victim's security tools – and broke their own encryptor theregister.com ↗

Independent corroboration explaining why Akira's memory-intensive encryptor is structurally incompatible with Safe Mode.

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt bleepingcomputer.com ↗

Secondary reporting summarising the Huntress findings and recommended mitigations.