Full Report
An Akira affiliate rebooted into Safe Mode to kill EDR and Defender, then Safe Mode broke their own ransomware. Here’s the full attack chain.
Analysis Summary
# Incident Report: Akira Affiliate Safe Mode EDR Evasion Attempt
## Executive Summary
An Akira ransomware affiliate gained initial access to a target network via an unsecured SonicWall SSL VPN. The attacker attempted to evade EDR and Microsoft Defender by rebooting the compromised host into "Safe Mode with Networking," which successfully disabled security services but ultimately caused the ransomware to crash due to memory constraints. Although the encryption phase failed, the attacker successfully exfiltrated sensitive credentials and file shares, maintaining the threat of double extortion.
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** August 4, 2026
- **Affected Organization:** Not disclosed
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** August 4, 2026, 03:45 UTC
- **Vector:** Credential Spraying against SonicWall SSL VPN.
- **Details:** After seven minutes of failed attempts, the attacker successfully logged into a VPN account that lacked Multi-Factor Authentication (MFA).
### Lateral Movement
- **Details:** The attacker accessed the Domain Controller (DC) via RDP approximately two hours after initial access. They utilized native tools and scripts to enumerate Active Directory (creating `AdUsers.txt` and `AdComp.txt`).
### Data Exfiltration/Impact
- **Details:** The attacker staged data using WinRAR and uploaded it to cloud storage. Impact included the compromise of administrative credentials and theft of internal file shares.
### Detection & Response
- **Discovery:** Detected by Huntress telemetry monitoring the abrupt cessation of agent heartbeats followed by the unusual boot configuration.
- **Response Actions:** The security provider alerted the victim organization. Microsoft Defender quarantined the ransomware payload only after the system was rebooted back into "Normal Mode."
## Attack Methodology
- **Initial Access:** SonicWall SSL VPN (Credential Spraying).
- **Persistence:** Remote Desktop Protocol (RDP) via compromised VPN credentials.
- **Privilege Escalation:** Domain Controller compromise.
- **Defense Evasion:** Rebooting into **Safe Mode with Networking** to prevent EDR/AV drivers from loading.
- **Credential Access:** Active Directory enumeration and dumping.
- **Discovery:** AD reconnaissance using `AdUsers.txt` and `AdComp.txt` dumps.
- **Lateral Movement:** RDP.
- **Collection:** Staging data using WinRAR.
- **Exfiltration:** Cloud-based upload.
- **Impact:** Failed encryption due to "out-of-virtual-memory" error in Safe Mode; successful data theft for extortion.
## Impact Assessment
- **Financial:** Not disclosed; potential extortion costs.
- **Data Breach:** Stolen Active Directory information and internal file shares.
- **Operational:** Temporary disruption due to forced reboots and system instability in Safe Mode.
- **Reputational:** Risk associated with potential data leak on Akira's extortion site.
## Indicators of Compromise
- **Network:** Successful VPN logins from unauthorized external IPs (e.g., associated with credential spraying).
- **File:** `AdUsers.txt`, `AdComp.txt`, and WinRAR archives in unusual directories.
- **Behavioral:**
- Forced reboot into Safe Mode (`bcdedit /set {current} safeboot network`).
- Sudden cessation of EDR/AV heartbeats.
- Out-of-memory errors associated with ransomware binaries.
## Response Actions
- **Containment:** Revocation of compromised VPN credentials and implementation of MFA.
- **Eradication:** Removal of ransomware binaries and staged data archives.
- **Recovery:** Restoration of normal boot configuration; password resets for all enumerated AD users.
## Lessons Learned
- **Safe Mode is a Blind Spot:** Attackers are increasingly using Safe Mode to bypass modern EDR, as most third-party security agents do not load in this state.
- **Self-Sabotage:** Minimalist environments like Safe Mode can break complex malware that relies on specific Windows sub-systems or memory allocations.
- **MFA is Mandatory:** The lack of MFA on the VPN was the primary enabler of this entire attack chain.
## Recommendations
- **Enforce Multi-Factor Authentication (MFA):** Implement MFA on all external-facing services, especially VPNs.
- **Monitor Boot Configuration Changes:** Alert on the use of `bcdedit` or changes to the Windows Boot Configuration Data (BCD) that trigger Safe Mode.
- **Patch Edge Devices:** Ensure SonicWall and other VPN appliances are fully patched against known vulnerabilities.
- **EDR Hardening:** Utilize EDR solutions that can detect and alert on a "graceful" shutdown or transition into Safe Mode.