Listen to this Post
A New Ransomware Tactic Raises an Old Security Problem
Ransomware attacks are becoming less dependent on sophisticated malware and increasingly focused on abusing legitimate Windows features. In a recent incident investigated by Huntress, an Akira ransomware affiliate demonstrated exactly how dangerous that shift can be: instead of trying to defeat endpoint security directly, the attacker simply rebooted a compromised machine into Safe Mode with Networking and used that restricted environment to disable security protections.
The incident is a powerful reminder that endpoint detection and response (EDR) is only as strong as the operating environment in which it runs. If an attacker can manipulate that environment, even well-configured security software may temporarily become blind.
The attack began with something much less exotic: an exposed SonicWall VPN account without multi-factor authentication. From there, the attacker moved rapidly through the victim’s environment, accessed the domain controller, explored Active Directory, stole files and credentials, deployed remote-access software, and attempted to prepare the system for ransomware deployment.
The encryption stage ultimately failed. But that should not be mistaken for a failed attack.
The attacker still achieved data theft and credential compromise in less than five hours.
The Attack Started With an Unprotected VPN
According to Huntress, the intrusion occurred on August 4 after the Akira affiliate obtained access through an exposed SonicWall VPN endpoint.
The VPN account did not have MFA enabled, giving the attacker a relatively straightforward path into the environment once valid credentials were obtained.
This is one of the most important lessons from the incident: sophisticated ransomware operations do not necessarily begin with sophisticated exploits.
Sometimes they begin with a password.
A VPN represents a particularly valuable entry point because successful authentication can immediately place an attacker inside the organization’s trusted network perimeter. If additional controls are missing, the attacker may be able to behave like a legitimate employee or administrator.
Two Hours Later, the Domain Controller Was in Sight
Huntress observed that approximately two hours after the successful VPN login, the attacker connected to the domain controller through Remote Desktop Protocol.
The attacker then began enumerating Active Directory users and computers.
This stage is critical because it reveals how quickly an intrusion can evolve from a single compromised account into an enterprise-wide threat.
By learning which systems existed, which users had privileges, and where important infrastructure was located, the attacker could identify the machines most valuable for both lateral movement and extortion.
The attacker subsequently moved to an application server, expanding the scope of the compromise.
Data Theft Came Before Ransomware
The operation was not immediately about encrypting files.
The attacker first concentrated on stealing information.
WinRAR was used to archive mapped file shares, while the s5cmd command-line utility was used to upload stolen data to an attacker-controlled Amazon S3 bucket.
This is an increasingly important ransomware pattern.
Modern ransomware attacks frequently operate as data-extortion campaigns first and encryption campaigns second. If the attackers can steal sensitive documents, credentials, intellectual property, or business records, they already possess leverage even if encryption fails.
That is exactly what happened here.
AnyDesk Became the
After collecting data, the attacker installed AnyDesk, a legitimate remote-access application.
This technique illustrates another major challenge facing defenders.
Security teams must distinguish between malicious software and legitimate software being used maliciously. Remote-management tools can be extremely useful for businesses, administrators, and IT support teams, but they can also provide attackers with persistent interactive access.
Once AnyDesk was available, the attacker gained another mechanism for controlling the compromised machine.
Then the operation became considerably more aggressive.
The EDR Blind Spot Was Windows Safe Mode
The attacker used AnyDesk to force the compromised system to restart into Safe Mode with Networking.
Safe Mode is a legitimate Windows troubleshooting environment. It starts Windows with a limited collection of drivers and services so administrators can diagnose problems that might prevent normal operation.
That legitimate purpose creates a security weakness.
Many third-party security agents and supporting services do not operate normally in Safe Mode.
Huntress found that the attacker exploited this behavior to disable the Huntress agent and Microsoft’s Defender real-time protection.
For approximately ten minutes, the compromised host effectively had no functioning EDR protection while antivirus defenses were blinded.
That short window was enough to demonstrate how dangerous an apparently harmless Windows recovery feature can become when controlled by an attacker.
The Attackers Modified the Safe Mode Registry
The attackers did more than simply reboot into Safe Mode.
They modified the Windows Safe Mode configuration so that AnyDesk could continue running after the reboot.
This was particularly significant because Safe Mode normally prevents many ordinary applications and services from starting.
By adding AnyDesk to the relevant Safe Mode registry configuration, the attackers attempted to preserve remote access even after moving into the restricted environment.
In other words, they were not merely using Safe Mode.
They were adapting Safe Mode to their attack.
The Ransomware Payload Hit an Unexpected Wall
The attackers then attempted to launch the primary Akira ransomware executable, akira.exe, through AnyDesk.
But the plan did not work.
The ransomware failed to execute successfully because Windows reported low virtual memory, producing out-of-memory and PowerShell-related errors.
This unexpected technical problem prevented the attackers from completing the encryption stage.
It is an unusual twist in the incident: the security defenses were successfully weakened, yet the ransomware itself was unable to finish the job.
That distinction matters.
A security control failure does not automatically mean a successful ransomware deployment, just as a failed ransomware payload does not mean the organization was safe.
Microsoft Defender Eventually Found the Payload
Although real-time protection had been disabled while the machine was in Safe Mode, Microsoft Defender still performed a scheduled scan.
That scan detected the Akira executable.
However, Defender could not immediately remove the malicious file because the system remained in Safe Mode.
The situation changed after the attacker rebooted the machine into normal Windows operation.
Once normal operation was restored,
The security product ultimately succeeded, but only after the attacker-controlled Safe Mode environment disappeared.
Encryption Failed, But the Attack Did Not
This is perhaps the most important point in the entire incident.
The ransomware did not successfully encrypt the
Yet the attacker still stole credentials and sensitive information.
They also gained access to internal systems and prepared the environment for ransomware deployment.
All of this happened in less than five hours from the initial compromise.
Calling this a failed ransomware attack would therefore be misleading.
The encryption component failed.
The intrusion did not.
Akira Is Not the First Ransomware Family to Exploit Safe Mode
Huntress noted that other ransomware groups and families, including Snatch and AvosLocker, have previously used Safe Mode to interfere with security protections.
What makes this incident particularly notable is that Huntress observed the technique being used in an Akira attack for the first time.
This suggests that the tactic is continuing to spread across ransomware ecosystems.
Attackers do not need to invent a new technique every time.
Once a technique proves effective against endpoint security, it can be copied, automated, and incorporated into other ransomware playbooks.
Why Safe Mode Deserves More Attention
Safe Mode is rarely the first thing organizations think about when designing ransomware defenses.
Security teams usually focus on malware execution, credential theft, suspicious PowerShell commands, lateral movement, privilege escalation, and abnormal encryption activity.
All of those remain important.
But this incident demonstrates that defenders must also monitor changes to the operating system’s boot and service configuration.
A system unexpectedly entering Safe Mode should not necessarily be treated as routine maintenance.
In a production environment, an unexplained Safe Mode reboot combined with remote-access software installation and security-agent disappearance should be considered highly suspicious.
The Real Weakness Was the Combination of Small Gaps
No single mistake explains this attack.
Instead, several weaknesses formed a chain.
The initial entry point lacked MFA.
The attacker obtained valid credentials.
Remote access through RDP was possible.
Active Directory enumeration was possible.
Sensitive file shares were accessible.
A remote-access application could be installed.
Safe Mode could be manipulated.
Security services could be disabled during that state.
Each weakness alone might not have resulted in a catastrophic breach.
Together, they created a pathway from one stolen credential to enterprise-level compromise.
MFA Could Have Broken the Attack Chain Early
Huntress recommends enabling MFA for VPN accounts, and this remains one of the most effective defensive measures highlighted by the incident.
MFA does not eliminate every form of credential compromise, but it dramatically raises the difficulty of using stolen credentials against exposed remote-access infrastructure.
Organizations should prioritize MFA for:
VPN services
Remote Desktop gateways
Cloud administration
Privileged accounts
Remote-management platforms
Identity-provider accounts
The earlier an attack is stopped, the fewer opportunities defenders need to contain it later.
Credential Spraying Must Also Be Detected
Huntress also recommends strengthening detection for credential-spraying activity.
Credential spraying differs from traditional brute-force attacks because the attacker attempts a small number of common or stolen passwords across many accounts rather than repeatedly attacking a single account.
That can make the activity harder to detect if monitoring is focused only on repeated authentication failures.
Organizations should look for unusual authentication patterns, geographically impossible access, abnormal VPN logins, unexpected successful authentication following repeated failures, and account activity inconsistent with normal user behavior.
Remote-Access Software Needs Context
AnyDesk is not inherently malicious.
That is exactly why attackers like tools such as it.
Security teams should therefore avoid simplistic rules that treat every installation of legitimate remote-access software as malware.
Instead, defenders should ask:
Who installed it?
When was it installed?
Which account performed the installation?
Was the machine supposed to have remote-access software?
Was the software configured to start automatically?
Was it installed immediately before a Safe Mode reboot?
Context transforms an otherwise legitimate administrative tool into a potentially powerful detection signal.
Deep Analysis: Detecting Safe Mode Abuse
Check the Current Boot Configuration
Administrators can inspect the Windows boot configuration with:
bcdedit /enum
Look for unexpected Safe Mode settings such as:
safeboot
safeboot network
A production endpoint unexpectedly configured to boot into Safe Mode should trigger investigation.
Review Safe Mode Registry Configuration
The Windows registry contains configuration information controlling which services and drivers operate in Safe Mode.
Defenders can inspect the relevant registry locations with:
reg query HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot
Suspicious additions should be investigated, particularly when they correspond to remote-access tools or unfamiliar executables.
Investigate AnyDesk Installation
Security teams can search for AnyDesk-related processes and services:
Get-Process | Where-Object {$_.ProcessName -like "AnyDesk"}
They can also inspect installed services:
Get-Service | Where-Object {$_.DisplayName -like "AnyDesk"}
The presence of AnyDesk is not proof of compromise, but an unexpected installation during an active security incident is a major contextual indicator.
Check Windows Event Logs
Organizations should correlate Windows Event Logs around unexpected reboots.
Useful sources include:
System
Security
Microsoft-Windows-PowerShell/Operational
Microsoft-Windows-WMI-Activity/Operational
Administrators can query recent system events with:
Get-WinEvent -LogName System -MaxEvents 100
The objective is not simply to find a single malicious event.
The objective is to reconstruct the sequence.
VPN login → RDP access → discovery → archive creation → data transfer → AnyDesk installation → Safe Mode configuration → security-agent disruption.
That sequence is far more valuable than any individual alert.
Search for Security-Agent Tampering
Defenders should monitor for commands and configuration changes associated with stopping security products.
For example:
Get-Service | Where-Object {$_.DisplayName -match "Defender|Huntress|Security|Endpoint"}
Unexpected attempts to stop or disable security services should receive high priority.
Organizations using EDR should also investigate telemetry gaps.
If an endpoint suddenly stops reporting immediately before a suspicious reboot, that absence itself can become an alert.
Monitor for Abnormal Reboots
A Safe Mode transition should be correlated with user activity, administrative tickets, patching activity, and security events.
A legitimate troubleshooting reboot may have a corresponding help-desk record.
An unexplained Safe Mode reboot followed by remote-access activity is a completely different situation.
The distinction is operational context.
Watch for Data Staging Before Encryption
The use of WinRAR and s5cmd demonstrates why organizations should not wait for ransomware encryption to begin before declaring an incident.
Commands involving archive creation, large file transfers, cloud storage uploads, and unusual S3 activity can provide earlier warning.
For example, defenders can investigate unusual archive creation with:
Get-Process | Where-Object {$_.ProcessName -match "winrar|7z|rar"}
Network telemetry should also be reviewed for unexpected uploads to cloud storage providers.
The 37% Figure Requires Context
The supplied article also references a broader finding that only 37% of attacker actions using valid credentials were blocked.
That statistic should not be interpreted as meaning that every organization will block only 37% of credential-based attacks.
It is a measurement from a specific security-testing dataset and methodology.
The larger lesson, however, is highly relevant: prevention performance can look strong before an attacker obtains valid credentials and deteriorate dramatically afterward.
That makes identity security, behavioral detection, least privilege, and post-compromise visibility essential components of ransomware defense.
What Undercode Say:
- The Most Dangerous Part Was Not Akira
The ransomware itself was not the most interesting component of this attack.
The real story was the
- Safe Mode Is Becoming an Offensive Tool
Safe Mode was designed to help administrators repair broken computers.
Attackers are increasingly discovering that the same functionality can help them suppress security controls.
3. EDR Is Not Invincible
EDR is powerful, but it is still software operating inside an operating system.
If the operating environment is compromised or intentionally altered, visibility can disappear.
4. Ten Minutes Can Be Enough
The attackers had approximately ten minutes of reduced endpoint visibility.
In modern ransomware operations, ten minutes can be an eternity.
A threat actor can execute commands, alter configurations, steal credentials, and establish persistence extremely quickly.
5. The VPN Was the Real Beginning
The attack did not begin with Safe Mode.
It began with an exposed VPN account that lacked MFA.
That is where defenders had the easiest opportunity to stop the entire chain.
6. Identity Has Become the New Perimeter
Once attackers possess valid credentials, they can often move through environments while appearing legitimate.
Identity monitoring therefore deserves the same attention traditionally given to malware detection.
7. Legitimate Tools Make Detection Harder
WinRAR, AnyDesk, PowerShell, RDP, and cloud-storage utilities can all have legitimate business purposes.
Attackers exploit that ambiguity.
8. Context Beats Simple Blocklists
Blocking every remote-access tool is unrealistic.
Detecting an unexpected remote-access tool installed shortly before Safe Mode activation is much more powerful.
- Data Theft Can Be More Important Than Encryption
The failure of akira.exe did not undo the earlier theft.
Sensitive data can remain useful to criminals even when ransomware encryption fails.
10. Ransomware Has Become an Extortion Business
Encryption is now only one component of the ransomware economy.
Credential theft, data theft, public pressure, and threats of disclosure can independently generate leverage.
- Safe Mode Changes Should Be High-Value Signals
Organizations should consider unexpected Safe Mode configuration changes a meaningful security event.
They should be correlated with authentication and endpoint telemetry.
12. Security-Agent Disappearance Is Also a Signal
An endpoint that suddenly stops reporting to EDR should never automatically be treated as a technical problem.
It may be a security event.
- Remote Access After EDR Loss Is Especially Suspicious
An attacker installing AnyDesk immediately before or during a security-agent outage creates a highly suspicious sequence.
That sequence should be investigated aggressively.
14. Attackers Are Learning the Operating System
Modern ransomware operators increasingly understand Windows administration deeply.
They exploit configuration, services, boot mechanisms, authentication, and legitimate management features.
15. Defenders Need the Same Knowledge
Security teams cannot rely entirely on antivirus signatures.
They need to understand how Windows actually works.
16. Monitoring the Boot Process Matters
Boot configuration is part of the attack surface.
Organizations should monitor unexpected changes to BCD settings and Safe Mode configuration.
17. Registry Monitoring Can Reveal Persistence
The attackers modified the Safe Mode registry to keep AnyDesk available.
That type of persistence can leave valuable forensic evidence.
18. Scheduled Scans Still Have Value
Defender’s scheduled scan eventually detected the ransomware executable.
That demonstrates why layered security remains important even when real-time protection is temporarily impaired.
19. Defense in Depth Saved the Situation
The organization did not rely on one security mechanism.
Multiple layers ultimately contributed to limiting the impact.
- But Layered Defense Must Include Recovery States
Traditional defense-in-depth models often focus on normal Windows operation.
Safe Mode should also be considered.
21. VPN Security Should Be Non-Negotiable
Internet-facing VPN infrastructure should be protected with MFA, strong authentication policies, monitoring, and rapid patching.
22. RDP Requires Special Attention
Direct or overly permissive RDP access can dramatically accelerate lateral movement.
Organizations should minimize exposure and enforce strong authentication.
- Active Directory Enumeration Is an Early Warning
Attackers rarely enumerate users and computers without a reason.
Discovery activity should be correlated with authentication anomalies.
- Cloud Storage Can Become an Exfiltration Channel
S3 and similar services are legitimate infrastructure.
That makes monitoring data movement especially important.
25. Archive Utilities Should Not Be Ignored
Large archive creation shortly after suspicious authentication can indicate preparation for data theft.
26. Attack Chains Must Be Correlated
The strongest detection may not be one alert.
It may be five individually moderate alerts occurring within 30 minutes.
27. Prevention Scores Can Hide Post-Compromise Risk
A strong perimeter does not guarantee strong post-authentication defense.
Organizations must measure what happens after credentials are stolen.
28. Privilege Reduction Matters
Even if attackers obtain one account, least privilege can limit what that identity can reach.
29. Credential Theft Should Trigger Rapid Response
If credentials are believed compromised, password resets alone may not be sufficient.
Tokens, sessions, privileged credentials, and persistence mechanisms should also be investigated.
30. EDR Gaps Need Automatic Escalation
Security platforms should alert when endpoints unexpectedly stop communicating.
Silence should not be invisible.
31. Ransomware Detection Should Start Before Encryption
Waiting for mass file modifications is waiting too long.
The attack chain often provides warning much earlier.
32. Safe Mode Can Become a Canary
Unexpected Safe Mode activity on a server can be treated as a high-value behavioral indicator.
33. Remote Tools Need Allowlisting and Monitoring
Organizations should maintain an inventory of approved remote-access applications.
Anything outside that inventory deserves additional scrutiny.
34. Administrative Actions Need Attribution
Security teams should be able to determine which account changed boot settings, installed software, or modified services.
35. Windows Configuration Is Security Telemetry
Boot settings, services, registry entries, scheduled tasks, and security policies all provide evidence.
36. Attackers Prefer Predictable Weaknesses
They do not necessarily need zero-days when organizations leave common security controls disabled.
37. MFA Could Have Changed Everything
The simplest control in the entire story may have been the most powerful.
A properly enforced MFA policy could have prevented the stolen VPN credentials from becoming an internal foothold.
- Encryption Failure Should Not Create False Confidence
Organizations should not judge incident severity solely by whether ransomware encrypted files.
Data theft can be equally damaging.
39. Safe Mode Defense Should Become Standard
Security teams should test whether their endpoint controls remain visible, functional, and recoverable during unusual Windows startup states.
40. The Bigger Lesson Is About Resilience
The goal is not to build a system that can never be compromised.
The goal is to build one in which a compromised credential does not automatically become a compromised enterprise.
✅ Akira Was Used in the Attack
Huntress reported observing an Akira ransomware affiliate using the Safe Mode technique during the incident.
The ransomware payload itself failed to complete encryption, but the Akira executable was present and attempted to run.
The important distinction is that the attack involved Akira even though the final encryption stage was unsuccessful.
✅ Safe Mode Was Used to Disable Security Visibility
The attackers rebooted the compromised host into Safe Mode with Networking and disabled the Huntress agent and Microsoft Defender real-time protection.
Huntress reported approximately ten minutes during which the host lacked working EDR visibility.
This is consistent with the described attack sequence.
✅ Data Was Stolen Before the Ransomware Failed
The attackers used WinRAR to archive mapped file shares and s5cmd to transfer data to an attacker-controlled S3 bucket.
The incident therefore involved successful data theft regardless of the failed encryption attempt.
This supports the broader conclusion that ransomware incidents should be assessed for extortion and data compromise, not encryption alone.
❌ “Failed Encryption” Does Not Mean “Failed Attack”
Although akira.exe failed because of memory-related errors, the attacker still obtained credentials and files.
The compromise therefore produced meaningful impact even without widespread encryption.
Calling the entire operation unsuccessful would understate the consequences.
❌ Safe Mode Is Not an Akira-Exclusive Technique
Huntress specifically noted that ransomware families such as Snatch and AvosLocker have used similar Safe Mode tactics.
Akira’s use of the technique represents another example of an existing ransomware strategy rather than a completely new invention.
Prediction
(+1) Safe Mode Monitoring Will Become a More Common Enterprise Security Control
As ransomware operators increasingly abuse legitimate Windows functionality, security vendors are likely to improve detection around boot configuration changes, Safe Mode activation, security-agent tampering, and suspicious remote-access persistence.
Organizations will gradually treat unexpected Safe Mode transitions as potential indicators of compromise rather than ordinary troubleshooting events.
The broader direction of ransomware defense is also likely to move away from simply detecting malicious executables.
Future detection systems will increasingly focus on behavioral chains: suspicious authentication followed by discovery, remote-access deployment, data staging, security-agent disruption, and unusual boot configuration changes.
The most resilient organizations will not depend on a single EDR agent to stop ransomware.
They will combine MFA, identity monitoring, least privilege, network segmentation, endpoint telemetry, cloud logging, backup protection, behavioral detection, and rapid incident response.
The Akira incident offers a warning that is easy to overlook: sometimes the attacker does not need to defeat the security software.
They only need to find a way to make the operating system stop running it.
▶️ Related Video (76% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: www.bleepingcomputer.com
Extra Source Hub (Possible Sources for article):
https://www.facebook.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
