A ransomware affiliate linked to the Akira group attempted an unusual defence-evasion technique during an August 4 intrusion, forcing a compromised Windows machine to reboot into Safe Mode with Networking in order to disable endpoint detection tools before deploying ransomware. The attack, documented by managed detection and response firm Huntress, ultimately failed to encrypt the target’s files, though the attacker still succeeded in stealing credentials and data within less than five hours of gaining initial access.
The incident offers a rare, granular window into how quickly a modern ransomware operation can escalate from a single point of entry to full network compromise, and illustrates a growing trend among ransomware crews to disable security software by exploiting legitimate operating system functionality rather than deploying custom malicious tools that are more likely to be flagged.
A Five-Hour Path from VPN to Data Theft
According to Huntress, the intrusion began when the attacker obtained initial access through an exposed SonicWall VPN device that lacked multi-factor authentication, a weakness that has become one of the most consistently exploited entry points across the ransomware landscape over the past two years. Roughly two hours after logging in, the attacker connected to the organisation’s domain controller using Remote Desktop Protocol, enumerated Active Directory users and computers, and then moved laterally to an application server.
From there, the attacker used the archiving tool WinRAR to compress data from mapped file shares before uploading the stolen files to an attacker-controlled cloud storage bucket using a command-line utility. The attacker then installed AnyDesk, a legitimate remote access application frequently repurposed by ransomware operators, to maintain persistent control over the compromised host even after initial access points were potentially discovered and closed.
Exploiting Safe Mode to Blind Security Software
The most distinctive element of the intrusion came next, when the attacker used AnyDesk to force the compromised machine to restart into Safe Mode with Networking, a Windows diagnostic state that loads only a minimal set of drivers and services and typically prevents third-party security software from functioning. For roughly ten minutes while the system remained in this state, Huntress found that the endpoint detection agent protecting the host had no working visibility, and built-in antivirus protection was similarly blinded.
Crucially, the attacker had already modified the Windows registry to ensure AnyDesk itself would continue running even inside Safe Mode, preserving remote access throughout the reboot. When the attacker attempted to launch the main Akira ransomware payload while still in this blinded state, however, the execution failed, with the system reporting insufficient virtual memory and generating a series of operational errors that prevented the encryption routine from running.
A Recovery That Still Ended in Data Theft
A scheduled antivirus scan later detected the ransomware executable even while real-time protection remained disabled in Safe Mode, though the security software could not remove the file until the attacker eventually rebooted the machine back into normal operating mode, at which point real-time protection resumed and the malicious file was quarantined. Despite this technical failure to encrypt the victim’s data, the attacker had already exfiltrated files and credentials earlier in the intrusion, meaning the organisation still faces the threat of data extortion even without a successful encryption event.
Huntress noted that other ransomware families, including Snatch and AvosLocker, have used the Safe Mode evasion tactic for several years, but this marked the first time the firm had observed an Akira affiliate deploying it. The technique’s growing adoption across different ransomware groups reflects a broader shift towards abusing built-in operating system features rather than custom evasion tools, a shift that makes detection considerably harder for security teams relying on signature-based defences.
Why Akira Remains a Persistent Global Threat
Akira has grown into one of the most active ransomware-as-a-service operations globally since its emergence in March 2023, with law enforcement agencies estimating the group has collected more than $244 million in ransom payments to date. The group’s affiliates have consistently favoured manufacturing, professional services, technology and financial services organisations, and have shown a repeated pattern of exploiting VPN devices lacking multi-factor authentication as an initial foothold, precisely the vector used in this latest incident.
Security researchers tracking the group recommend that organisations enforce multi-factor authentication across all VPN accounts without exception, deploy detection measures for credential-spraying attempts, and specifically monitor for unauthorised changes to Safe Mode boot configurations or the addition of remote access tools to the Safe Mode service registry, since both are now recognised indicators of this evasion technique in progress.
