Listen to this Post
A Dangerous Attack With an Unexpected Failure
Ransomware operators are constantly looking for ways to turn legitimate Windows recovery mechanisms into weapons. One of the most effective tricks is to reboot a compromised machine into Safe Mode with Networking, where many security products and background services may not operate normally.
That is exactly what happened during a recent Akira ransomware intrusion described by Huntress. An Akira affiliate gained access through an exposed SonicWall VPN that did not have multifactor authentication enabled, moved through the victim’s environment, stole credentials and data, weakened endpoint defenses, and attempted to launch the ransomware while the system was operating in Safe Mode.
The attack almost worked.
The attacker successfully created a period in which endpoint detection and response protections were effectively blind. Microsoft Defender’s real-time protection was also unavailable. Remote access was deliberately preserved through AnyDesk, allowing the operator to maintain control after the reboot.
But then something unexpected happened.
Akira’s own encryption process apparently ran out of virtual memory.
The ransomware failed to encrypt the machine, not because the defensive controls stopped it, but because the stripped-down Safe Mode environment did not provide enough memory for the payload to operate correctly.
That distinction is critical. The incident should not be interpreted as evidence that Safe Mode is an effective ransomware defense. Instead, it demonstrates how unpredictable modern intrusion chains can become when attackers manipulate operating-system recovery mechanisms.
The Initial Entry Came Through an MFA-Less SonicWall VPN
According to Huntress, the intrusion began on August 4 when an Akira affiliate successfully accessed an exposed SonicWall VPN.
The VPN account did not have multifactor authentication enabled, giving the attacker a much easier path into the environment. The successful login was recorded at approximately 03:52 UTC after what investigators described as credential-spraying activity.
This first step illustrates one of the oldest problems in enterprise security: sophisticated ransomware does not necessarily require a sophisticated initial exploit.
Sometimes attackers simply need a valid username and password.
Two Hours of Quiet Before the Attack Accelerated
The attackers did not immediately begin encrypting systems.
Instead, there was roughly a two-hour period of activity before the intrusion escalated.
This delay is important because ransomware operations increasingly behave less like traditional malware infections and more like human-led compromises.
The attackers first establish access, determine where they are, identify valuable systems, discover accounts and shares, and collect information.
Only after they understand the environment do they begin damaging it.
The Domain Controller Became a Critical Target
The operator eventually used Remote Desktop Protocol to access the domain controller.
Once there, the attackers performed extensive Active Directory enumeration.
They collected information about users and computers and used PowerShell-based discovery techniques to obtain detailed group-membership information.
One interesting technical detail was the use of PowerShell enumeration with truncation disabled.
That matters because standard command output can hide information when results are too large. Removing truncation allows an attacker to capture a more complete picture of the organization’s identity structure.
For defenders, this is a reminder that apparently ordinary administrative commands can become highly valuable reconnaissance tools after an account has been compromised.
File Shares Were Archived Before Encryption
The attackers then moved toward the
Mapped file shares were archived using WinRAR, reportedly with command-line options consistent with techniques previously associated with Akira campaigns.
This was not simply preparation for encryption.
It was preparation for extortion.
Modern ransomware groups frequently steal information before deploying their encryption payloads. The stolen files provide leverage even if the ransomware itself fails.
That is exactly what happened here.
Data Exfiltration Happened Before the Encryption Attempt
The collected data was uploaded to an attacker-controlled Amazon S3 bucket using s5cmd.
This sequence is one of the most important elements of the incident.
The attackers successfully extracted data before attempting encryption.
Therefore, even though the encryption stage ultimately failed, the victim was not necessarily safe from the financial and operational consequences of the attack.
The attackers could potentially still threaten publication or misuse of stolen information.
This is why ransomware defense can no longer focus exclusively on stopping akira.exe, locker.exe, or another encryption binary.
The real attack often begins long before the ransom note appears.
The Attackers Then Went After the Security Tools
Once reconnaissance and exfiltration were complete, the operators attempted to neutralize endpoint security.
Their method was particularly interesting.
Instead of simply killing individual security processes, the attackers rebooted the compromised host into Safe Mode with Networking.
Safe Mode starts Windows with a limited collection of drivers and services.
That reduced operating environment can prevent certain security products from loading normally.
For an attacker, this can create a temporary window in which defensive visibility is dramatically reduced.
AnyDesk Was Added Before the Reboot
The attacker understood that Safe Mode could also interfere with their own access.
To solve that problem, they configured AnyDesk to survive the reboot through the Safe Mode service registry configuration.
This was an important operational step.
The attacker wanted security tools to disappear while their own remote-access capability remained available.
That is a classic attacker objective:
Remove the defender’s visibility without removing the attacker’s control.
For approximately ten minutes, Huntress observed a system where EDR was not functioning normally and Microsoft Defender’s real-time protection was disabled.
From the
Almost.
Safe Mode Became the
At approximately 06:34 UTC, akira.exe was executed.
The ransomware then began creating the process activity associated with its encryption stage.
But roughly 13 seconds after the encryption process started, the system began producing memory-related errors.
The ransomware process apparently exhausted the available virtual memory inside the restricted Safe Mode environment.
Instead of encrypting the endpoint, the payload crashed into the limitations of the environment the attackers had deliberately created.
The irony is difficult to miss.
The attackers successfully defeated the security software, only to defeat themselves.
Why Safe Mode Broke the Encryption Process
Safe Mode is intentionally restrictive.
Windows loads a reduced set of drivers, services, and components compared with a normal boot.
That reduced environment can also change how memory and system resources are available to applications.
Huntress observed an “Out of Virtual Memory” condition around the same time the Akira process tree attempted to launch its encryption workload.
The result was catastrophic for the ransomware operation.
The payload could execute.
The security tools were weakened.
The attacker had remote access.
But the encryption stage could not successfully complete.
Defender Eventually Detected Akira
Microsoft
Ransom:Win32/Akira.B!ibt
However, Defender could not immediately quarantine the file because real-time protection was unavailable while the system remained in Safe Mode.
This created another strange situation.
The defensive software could recognize the malicious file, but it lacked the normal protection mechanisms required to immediately remove it.
The file remained present until the attacker rebooted the machine back into normal Windows mode.
That reboot restored
The
The Attacker Accidentally Restored the Defender
This is perhaps the most unusual part of the entire incident.
The attacker rebooted into Safe Mode to disable security protections.
But once the ransomware failed, the attacker returned the machine to normal operation.
That restored the security protections they had previously attempted to suppress.
The system effectively returned to a more defensible state because the attacker needed to leave Safe Mode.
It is a reminder that offensive techniques can introduce dependencies and unexpected failure points.
Akira Is Not the First Ransomware to Abuse Safe Mode
The technique itself is not new.
Huntress notes that ransomware families including Snatch and AvosLocker have used Safe Mode as part of their attack strategies for years.
The significant development is that Huntress observed this technique being used with Akira in its telemetry for the first time.
That makes the incident valuable from a defensive perspective.
Attackers are not necessarily inventing completely new techniques.
They are often combining established techniques in new ways.
The Same Attack Could Work Next Time
The biggest mistake defenders could make is celebrating this incident as a victory for Safe Mode.
It was not.
The ransomware failed because of an apparent resource limitation.
A machine with more physical RAM could behave differently.
A larger page file could change the outcome.
A modified Akira encryptor with a smaller memory footprint could potentially execute successfully.
Future affiliates could also alter their Safe Mode procedure.
In other words, the failure may be accidental rather than fundamental.
More Memory Could Mean More Damage
Imagine the same attack against a server with significantly more memory.
The attacker compromises the VPN.
They move laterally.
They access the domain controller.
They enumerate Active Directory.
They steal sensitive files.
They configure remote access.
They reboot into Safe Mode.
Security controls disappear.
Then the ransomware successfully starts.
That scenario could be considerably more destructive.
The lesson is therefore not that Safe Mode prevents Akira.
The lesson is that Akira happened to encounter an environmental limitation during this particular attack.
The Real Damage Had Already Happened
Even without encryption, the attack had already crossed several serious boundaries.
The attackers obtained initial access.
They reached privileged infrastructure.
They performed Active Directory reconnaissance.
They accessed file shares.
They archived data.
They exfiltrated information.
They disabled or bypassed important security controls.
Only the final encryption stage failed.
That distinction is extremely important when evaluating ransomware incidents.
A ransomware attack does not begin when files receive a .akira extension.
It begins when an unauthorized operator establishes persistent control over the environment.
Deep Analysis: Detecting Safe Mode Abuse Before Encryption
Watch for Boot Configuration Changes
Defenders should monitor for suspicious use of Windows boot configuration utilities such as bcdedit.exe.
A potentially relevant investigation command is:
Get-WinEvent -LogName "Microsoft-Windows-Kernel-Boot/Operational" |
Where-Object {$_.Id -eq 27} |
Select-Object TimeCreated, Id, Message
This can help security teams investigate Kernel-Boot events associated with unusual boot configuration changes.
Investigate SafeBoot Configuration
Administrators can inspect SafeBoot-related registry configuration with:
Get-ChildItem "HKLM:\SYSTEM\CurrentControlSet\Control\SafeBoot"
Unexpected services or remote-management software appearing in this area deserve immediate investigation.
Search for BootMode Changes
Another useful investigation is examining Kernel-General events:
Get-WinEvent -LogName "Microsoft-Windows-Kernel-General" |
Where-Object {$_.Id -eq 12} |
Select-Object TimeCreated, Id, Message
Huntress specifically highlights Kernel-General Event ID 12 with BootMode=2 as a useful signal for detecting Safe Mode activity.
Look for msconfig.exe
Attackers may use Windows configuration utilities to manipulate startup behavior.
Security teams can hunt for:
Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4688
} | Where-Object {$_.Message -match 'msconfig.exe'}
Process creation telemetry from an EDR or SIEM will generally provide better visibility than relying exclusively on Windows event logs.
Monitor bcdedit.exe
A suspicious process chain involving bcdedit.exe deserves attention.
For example:
Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4688
} | Where-Object {$_.Message -match 'bcdedit.exe'}
The important factor is not simply that bcdedit.exe executed.
Legitimate administrators may use it.
The concern is its combination with ransomware-like activity, credential theft, remote access installation, service manipulation, or unexpected reboot behavior.
Hunt for AnyDesk Service Manipulation
Remote-access software appearing around the same time as Safe Mode configuration is particularly suspicious.
A basic search can include:
Get-Service | Where-Object {
$_.Name -match 'AnyDesk|Remote|RMM'
}
Organizations should also examine service creation events and registry modifications.
The attacker in this incident deliberately attempted to make remote access survive the security-control disruption.
That behavior is a strong detection opportunity.
Monitor Service Shutdowns
A ransomware operator preparing Safe Mode may cause multiple legitimate services to stop.
That makes abnormal service termination a useful behavioral signal.
Security teams should correlate:
Boot configuration change
+
Service termination
+
Remote-access installation
+
Credential activity
+
Ransomware execution
Individually, these events may be explainable.
Together, they can represent an extremely strong intrusion signal.
Search for Suspicious WinRAR Activity
The attackers archived mapped shares before exfiltration.
Defenders can hunt for unusual WinRAR execution:
Get-WinEvent -FilterHashtable @{
LogName='Security'
Id=4688
} | Where-Object {$_.Message -match 'winrar.exe'}
The strongest detection logic should look for WinRAR activity involving network shares, large numbers of files, or execution from unusual user accounts.
Monitor s5cmd and Cloud Exfiltration
The use of s5cmd is another valuable indicator.
Organizations using Amazon S3 should monitor for unexpected cloud uploads, especially when they originate from endpoints that do not normally interact with company-controlled storage.
A suspicious chain could look like:
VPN login
→ RDP
→ Active Directory enumeration
→ File-share discovery
→ WinRAR
→ s5cmd
→ Safe Mode
→ Akira
That sequence is far more informative than looking for the ransomware binary alone.
Defend the VPN Entry Point
The most important lesson may actually be the first step of the attack.
The attacker entered through an MFA-less VPN.
Organizations using remote-access infrastructure should enforce multifactor authentication wherever possible.
VPN credentials are increasingly valuable targets because a valid account can allow attackers to bypass many perimeter defenses without exploiting a software vulnerability.
Restrict Administrative RDP
RDP access to domain controllers should be tightly controlled.
Administrative access should ideally originate from dedicated management systems, privileged-access workstations, or controlled jump hosts.
An unexpected external or compromised workstation reaching a domain controller through RDP should generate immediate scrutiny.
Protect the Domain Controller
Once attackers reach a domain controller, the security situation changes dramatically.
Active Directory enumeration can reveal the structure of the entire organization.
Defenders should therefore monitor unusual PowerShell execution, directory enumeration, credential-access activity, and administrative logons involving domain controllers.
Separate Backup Credentials
If attackers can obtain domain administrator credentials, they may eventually attempt to destroy or encrypt backups.
Backup infrastructure should use separate credentials and access paths wherever practical.
Immutable or otherwise protected backups also reduce the attacker’s ability to turn successful data destruction into an irreversible disaster.
What Undercode Say:
1. The VPN Was the Real Beginning
The story appears to be about Safe Mode, but the attack actually began with remote access.
- MFA Remains One of the Most Important Barriers
An MFA-less VPN gave credential-spraying activity a direct route into the environment.
3. Ransomware Is an Operational Process
Akira was not simply dropped onto the machine and executed.
Human operators performed reconnaissance, lateral movement, collection, exfiltration, defense evasion, and finally attempted encryption.
- The Domain Controller Was a Strategic Target
Access to Active Directory can transform one stolen credential into organization-wide intelligence.
5. Data Theft Happened Before Encryption
This is arguably more important than the failed encryption attempt.
- Ransomware Does Not Need Encryption to Cause Damage
Stolen information can support extortion even when encryption fails.
- Safe Mode Is Becoming an Offensive Weapon
Attackers increasingly understand that recovery environments can behave differently from normal Windows sessions.
8. EDR Is Not Invincible
Endpoint security depends on the operating environment being available and trustworthy.
9. Defense Evasion Can Create Blind Spots
When attackers manipulate the boot environment, conventional process-level monitoring may become less effective.
10. The Attackers Underestimated Their Own Payload
The Safe Mode trick succeeded against security controls but apparently created an environment where the ransomware could not operate.
- That Luck Should Not Become a Security Strategy
Defenders should never rely on Akira exhausting memory.
12. Attackers Learn From Failed Operations
A failed ransomware deployment provides intelligence to the adversary.
- The Next Akira Build Could Be Different
A more efficient encryptor could potentially eliminate the memory problem.
14. Hardware Configuration Matters
RAM and page-file configuration may influence whether the same payload succeeds.
15. Detection Must Focus on Behavior
Searching only for known Akira hashes is insufficient.
16. Boot Changes Are Valuable Indicators
Unexpected Safe Mode configuration should be treated seriously.
17. bcdedit.exe Deserves Attention
It is legitimate administrative software, but its suspicious use can reveal defense-evasion activity.
18. msconfig.exe Can Be Equally Important
Security teams should understand which administrators legitimately use it.
19. Remote Access Tools Can Reveal Persistence
AnyDesk appearing in Safe Mode-related configuration is particularly interesting.
- Attackers Want Their Own Access to Survive
The goal is not simply to disable security.
The goal is to disable security while maintaining attacker control.
21. Service Manipulation Is Another Signal
Multiple security and system services stopping simultaneously can indicate preparation for a ransomware event.
22. Cloud Exfiltration Is Increasingly Normal
Attackers can use legitimate cloud infrastructure to move stolen information away from the victim.
- S3 Does Not Automatically Mean Safe Storage
Cloud services can become part of an
24. WinRAR Is a Useful Hunting Signal
Unexpected mass archiving of file shares should trigger investigation.
25. PowerShell Remains Central to Intrusions
The tool itself is legitimate, but context determines whether its use is suspicious.
26. Quiet Periods Are Significant
The two-hour delay demonstrates that ransomware attacks can contain substantial reconnaissance phases.
27. Detection Should Correlate Events
A single suspicious event may be harmless.
A chain of related events can reveal the attack.
- The Best Signal May Be the Sequence
VPN access followed by RDP, enumeration, archiving, exfiltration, Safe Mode, and ransomware execution is highly suspicious.
29. EDR Blindness Should Trigger Secondary Controls
Organizations should not depend on one endpoint technology.
30. Network Telemetry Matters
If endpoint visibility disappears, network monitoring can still reveal abnormal communication.
- Identity Security Matters as Much as Endpoint Security
The attacker started with credentials rather than an exotic exploit.
32. Privileged Accounts Need Stronger Protection
Administrative credentials can dramatically accelerate lateral movement.
33. Domain Controllers Need Special Monitoring
They should never look like ordinary workstations from a security-monitoring perspective.
34. Ransomware Defense Begins Before Ransomware
Stopping initial access can prevent the entire chain.
35. Backups Remain Essential
Even sophisticated controls can fail.
36. Immutable Backups Reduce Leverage
Attackers have fewer options when backup systems cannot be easily modified or deleted.
- Safe Mode Abuse Should Become a Detection Category
Organizations should explicitly hunt for it rather than waiting for an incident.
38. Lucky Failures Are Dangerous Lessons
The victim benefited from an attacker mistake, not from a reliable defensive mechanism.
39. The Next Attempt May Be Cleaner
An affiliate with a modified payload could potentially achieve the encryption stage.
40. The Biggest Lesson Is Simple
The attacker lost the encryption battle, but the organization had already lost control of its environment.
✅ Akira Used Safe Mode as Part of the Attack
Huntress reported observing an Akira affiliate rebooting a compromised host into Safe Mode with Networking to interfere with endpoint security controls. This appears to be a genuine observed incident rather than theoretical speculation.
✅ The Ransomware Failed Because of a Memory Problem
The investigation linked the failed encryption attempt to an out-of-virtual-memory condition occurring shortly after akira.exe began its activity. The failure appears to have been caused by the constrained Safe Mode environment.
✅ Data Was Exfiltrated Before Encryption
The attackers archived file shares and uploaded stolen information to an attacker-controlled S3 bucket before attempting encryption. Therefore, the failed ransomware deployment did not eliminate the consequences of the intrusion.
✅ AnyDesk Was Used to Preserve Remote Access
The attackers configured AnyDesk to remain available through the Safe Mode reboot. This demonstrates deliberate planning to preserve attacker access while security controls were unavailable.
❌ Safe Mode Should Not Be Considered a Ransomware Defense
The fact that Akira failed in this particular environment does not mean Safe Mode reliably blocks ransomware. More memory, a larger page file, or a redesigned payload could potentially produce a completely different result.
Prediction
(+1) Attackers Will Continue Weaponizing Windows Recovery Environments
Safe Mode provides an attractive opportunity for ransomware operators because it can alter which defensive services are active. More ransomware families are likely to experiment with boot-level defense evasion.
(+1) Security Products Will Expand Boot-Level Detection
EDR vendors are likely to place greater emphasis on boot configuration changes, SafeBoot registry modifications, service manipulation, and suspicious reboot sequences.
(+1) Ransomware Hunting Will Become More Behavioral
Security teams will increasingly hunt for chains such as VPN compromise → RDP → Active Directory discovery → data staging → cloud exfiltration → Safe Mode → encryption.
(-1) Attackers May Eventually Fix the Memory Problem
The Akira failure could simply be a temporary weakness in one operational configuration. A future payload optimized for Safe Mode could potentially avoid the resource limitation that stopped this attack.
(+1) MFA Adoption Will Remain a Critical Defensive Priority
The incident demonstrates how an MFA-less remote-access service can become the gateway to a much larger compromise. Strong authentication can prevent many attacks before ransomware ever reaches the endpoint.
(+1) The Most Effective Defense Will Be Layered
No single control should be expected to stop a modern ransomware operation. Identity protection, VPN security, EDR, network monitoring, privileged-access controls, backup protection, and behavioral detection need to work together.
(-1) Organizations Relying Only on Endpoint Protection Face Growing Risk
If attackers can temporarily disable or bypass endpoint controls through boot manipulation, organizations without independent identity and network telemetry may experience dangerous visibility gaps.
(+1)
The most useful outcome of this incident is not that the ransomware crashed.
It is that defenders now have another behavioral pattern to hunt for: an attacker preparing the machine to reboot into a security-degraded environment while simultaneously ensuring their own remote access survives.
▶️ Related Video (74% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: securityaffairs.com
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
