Akira blinds EDR by rebooting a victim host into Safe Mode with Networking — the operator's first observed use of the technique, and the stripped-down boot starved its own encryptor
An Akira affiliate took a compromised Windows host into Safe Mode with Networking to strip its endpoint defences, which Huntress reports is the first time it has observed this operator using the technique — Snatch and AvosLocker have abused Safe Mode for years, but not Akira (Huntress, 2026-08-12). Everything around that step is the operator's familiar chain. From roughly 03:45 UTC on 4 August the SonicWall logged a burst of failed logins against multiple usernames from several external addresses, and about seven minutes later one succeeded against an SSL VPN with no multi-factor authentication in front of it; nearly two hours passed before any hands-on-keyboard activity (Huntress, 2026-08-12). The operator then reached the domain controller over RDP, spawned an elevated command shell, and ran full-property Get-ADUser and Get-ADComputer exports to files under C:\ProgramData — prefixed with $formatenumerationlimit = -1 so PowerShell's default four-item truncation would not clip multi-valued attributes such as group membership. Collection followed on an application server: WinRAR was installed mid-intrusion and used to recursively archive mapped file shares with the same flag string Huntress has documented in earlier SonicWall-entry Akira cases, and the archives went out to cloud object storage.
The evasion itself is three cheap steps. AnyDesk was installed as a service to carry both hands-on control and payload delivery; because third-party services do not start in Safe Mode — including the attacker's own — the operator first wrote that service into the Safe Mode allow-list with a single reg.exe add against HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network, then ran msconfig.exe at 06:29:21 UTC and forced the reboot. The host came back with Kernel-Boot event 27 recording a SAFEBOOT:NETWORK load option and Kernel-General event 12 recording BootMode = 2. Windows Defender logged event 3002 seconds into the boot, and Huntress states plainly that "For the entire Safe Mode window, the host had no working EDR, and AV was blinded" (Huntress, 2026-08-12).
What the operator did not anticipate is that the same stripped-down environment starved the ransomware. The encryptor launched at 06:34:29 UTC, and within about two minutes the host logged System event 26 for virtual-memory exhaustion and a cascade of PowerShell stack failures; it never encrypted. A scheduled Defender scan identified the binary at 07:43:50 UTC but its cleanup routine failed repeatedly because real-time protection was down, and quarantine only succeeded at 08:12:28 UTC — after the attacker rebooted back to normal operation at 08:10:38 UTC and thereby restored the very protection they had removed (Huntress, 2026-08-12). Huntress calls that "a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around", and notes that a host with more memory or a larger page file, or a retooled encryptor with a lighter footprint, could carry the same play to completion (Huntress, 2026-08-12).
Triage: Safe Mode with Networking is a legitimate diagnostic boot mode, so a lone Safe Mode boot is not the signal and IT-driven troubleshooting will generate them. The discriminators are what surrounds it: a SafeBoot Minimal or Network registry write naming a remote-access tool rather than a core Windows driver, a boot-configuration change made from an interactive session that traces back to an external VPN logon minutes earlier, and third-party security services stopping without a corresponding maintenance window. A genuine support-driven Safe Mode boot carries none of those, and the registry write in particular has no benign reason to name a remote-support binary.
Ransomware families like Snatch and AvosLocker have abused Safe Mode for years, but this is the first reported tie to Akira that Huntress has observed.
For the entire Safe Mode window, the host had no working EDR, and AV was blinded.
Alert on boot-configuration changes and Safe Mode boots: msconfig.exe / bcdedit activity, Kernel-Boot EID 27 with a SAFEBOOT load option, Kernel-General EID 12 BootMode=2, and third-party security services stopping (System EID 7036).
That's a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around.
Defender actions
- Sweep Windows event logs across servers and workstations for Kernel-Boot EID 27 carrying a SAFEBOOT load option and Kernel-General EID 12 with BootMode=2, and for writes under HKLM\\SYSTEM\\CurrentControlSet\\Control\\SafeBoot\\Minimal or \\Network that name a remote-access tool rather than a core OS driver; treat any hit with no change-ticket behind it as a live intrusion, because in Safe Mode the endpoint agent that would normally have told you was not running.
ATT&CK mapping
13 techniques mapped from the cited reporting · MITRE ATT&CK v19.2
Initial Access TA0001
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Execution TA0002
T1059.001Command and Scripting Interpreter: PowerShell
Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system. Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the <code>Start-Process</code> cmdlet which can be used to run an executable and the <code>Invoke-Command</code> cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Persistence TA0003
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
T1112Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
T1133External Remote Services
Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.
Privilege Escalation TA0004
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Stealth TA0005
T1078Valid Accounts
Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Defense Impairment TA0112
T1112Modify Registry
Adversaries may interact with the Windows Registry as part of a variety of other techniques to aid in defense evasion, persistence, and execution.
T1688Safe Mode Boot
Adversaries may abuse Windows safe mode to disable endpoint defenses. Safe mode starts up the Windows operating system with a limited set of drivers and services. Third-party security software such as endpoint detection and response (EDR) tools may not start after booting Windows in safe mode. There are two versions of safe mode: Safe Mode and Safe Mode with Networking. It is possible to start additional services after a safe mode boot.
Credential Access TA0006
T1110.003Brute Force: Password Spraying
Adversaries may use a single or small list of commonly used passwords against many different accounts to attempt to acquire valid account credentials. Password spraying uses one password (e.g. 'Password01'), or a small list of commonly used passwords, that may match the complexity policy of the domain. Logins are attempted with that password against many different accounts on a network to avoid account lockouts that would normally occur when brute forcing a single account with many passwords.
Discovery TA0007
T1018Remote System Discovery
Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system. Functionality could exist within remote access tools to enable this, but utilities available on the operating system could also be used such as Ping, <code>net view</code> using Net, or, on ESXi servers, `esxcli network diag ping`.
T1087.002Account Discovery: Domain Account
Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior such as targeting specific accounts which possess particular privileges.
Lateral Movement TA0008
T1021.001Remote Services: Remote Desktop Protocol
Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.
Collection TA0009
T1560.001Archive Collected Data: Archive via Utility
Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Command and Control TA0011
T1219Remote Access Tools
An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network. Remote access tools create a session between two trusted hosts through a graphical interface, a command line interaction, a protocol tunnel via development or management software, or hardware-level access such as KVM (Keyboard, Video, Mouse) over IP solutions. Desktop support software (usually graphical interface) and remote management software (typically command line interface) allow a user to control a computer remotely as if they are a local user inheriting the user or software permissions. This software is commonly used for troubleshooting, software installation, and system management. Adversaries may similarly abuse response features included in EDR and other defensive tools that enable remote access.
Exfiltration TA0010
T1567.002Exfiltration Over Web Service: Exfiltration to Cloud Storage
Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel. Cloud storage services allow for the storage, edit, and retrieval of data from a remote cloud storage server over the Internet.
Impact TA0040
T1486Data Encrypted for Impact
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.