Full Report
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]
Analysis Summary
# Incident Report: Akira Ransomware EDR Evasion via Safe Mode
## Executive Summary
An Akira ransomware affiliate successfully compromised an organization by leveraging an MFA-less VPN to gain initial access. The attacker attempted to evade Endpoint Detection and Response (EDR) and Antivirus (AV) solutions by forcing the system into Safe Mode with Networking. While the attacker successfully exfiltrated data, the final encryption stage failed due to system resource constraints, and the threat was ultimately mitigated upon a reboot to normal mode.
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** August 4, 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** August 4, 2026 (T+0:00)
- **Vector:** Exposed SonicWall VPN device.
- **Details:** Access was gained using valid credentials on a VPN account lacking multi-factor authentication (MFA).
### Lateral Movement
- **T+2:00:** Attacker connected to the Domain Controller via RDP.
- **T+2:15:** Enumerated Active Directory users and computers.
- **T+2:30:** Moved laterally to a targeted application server.
### Data Exfiltration/Impact
- **T+3:00:** Mapped file shares were archived using WinRAR.
- **T+3:30:** Stolen data was uploaded to an attacker-controlled AWS S3 bucket using the `s5cmd` utility.
- **Impact:** Credentials and proprietary files were stolen for extortion purposes.
### Detection & Response
- **T+4:00:** Attacker installed AnyDesk and forced a reboot into "Safe Mode with Networking" to disable Huntress and Microsoft Defender.
- **T+4:10:** Attacker attempted to execute `akira.exe` in Safe Mode; execution failed due to "low virtual memory" errors.
- **T+4:30:** A scheduled Microsoft Defender scan detected the payload, but could not remove it while in Safe Mode.
- **T+5:00:** System was rebooted into normal mode; EDR/AV services resumed and successfully quarantined the ransomware payload.
## Attack Methodology
- **Initial Access:** Valid accounts used on an MFA-less SonicWall VPN.
- **Persistence:** Installation of AnyDesk; modification of the Safe Mode registry to allow AnyDesk to run in Safe Mode.
- **Privilege Escalation:** Not explicitly detailed, but involved Domain Controller access via RDP.
- **Defense Evasion:** Rebooting into "Safe Mode with Networking" to prevent EDR/AV services from starting; disabling Defender Real-Time protection.
- **Credential Access:** Credential theft occurred during the compromise of the Domain Controller and application server.
- **Discovery:** Active Directory enumeration and file share mapping.
- **Lateral Movement:** RDP (Remote Desktop Protocol).
- **Collection:** Archiving files using WinRAR.
- **Exfiltration:** Use of `s5cmd` to transfer data to an external S3 bucket.
- **Impact:** Data theft and attempted (though failed) file encryption.
## Impact Assessment
- **Financial:** Costs associated with incident response, forensics, and potential extortion demands.
- **Data Breach:** Credentials and file shares exfiltrated; volume not specified.
- **Operational:** Limited; the primary encryption phase failed, preventing a total business shutdown.
- **Reputational:** Potential impact due to the breach of a VPN and Domain Controller.
## Indicators of Compromise
- **Network:** AWS S3 bucket connections via `s5cmd` [Defanged: s5cmd traffic to s3[.]amazonaws[.]com].
- **File:** `akira.exe`, `AnyDesk.exe`, `s5cmd.exe`, `WinRAR.exe`.
- **Behavioral:** Unexpected reboots into Safe Mode; registry modifications to `HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk`.
## Response Actions
- **Containment:** The system's natural resource limitations prevented encryption; a reboot restored security services.
- **Eradication:** Microsoft Defender quarantined the ransomware executable upon return to normal boot mode.
- **Recovery:** Restoration of normal operations and decommissioning of the compromised VPN credentials.
## Lessons Learned
- **MFA is Mandatory:** The lack of MFA on the VPN was the primary catalyst for the breach.
- **Safe Mode is a Blind Spot:** Traditional EDR/AV solutions may not load in Safe Mode, providing a window of opportunity for attackers to operate without monitoring.
- **Registry Monitoring:** Monitoring for changes to the SafeBoot registry key is a critical detection metric.
## Recommendations
- **Identity Security:** Implement Multi-Factor Authentication (MFA) on all external-facing services, especially VPNs and RDP.
- **Registry Hardening:** Enable alerts for modifications to the `SafeBoot` registry keys.
- **EDR Configuration:** Inquire with EDR vendors regarding "Safe Mode protection" features that allow agents to run in diagnostic modes.
- **Network Egress Filtering:** Block or alert on common data exfiltration tools (like `s5cmd`) and unauthorized remote access software (AnyDesk) at the network perimeter.