A recently uncovered Akira ransomware attack highlights a clever tactic employed by hackers to disable endpoint detection and response (EDR) solutions, allowing them to steal data without encryption. The attackers obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA), before disabling the EDR solution on a compromised system by restarting it into Safe Mode with Networking.
In this specific case, the hackers connected to the domain controller via Remote Desktop Protocol (RDP) and enumerated Active Directory users and computers. They then moved to an application server, where they used WinRAR to archive mapped file shares and the s5cmd command-line tool to upload the stolen data to an attacker-controlled S3 bucket. The attackers installed AnyDesk for remote access, which allowed them to force the compromised host to boot into Safe Mode with Networking.
Safe Mode is a Windows startup state designed for troubleshooting and diagnostic operations, starting Windows with a limited set of drivers and services that generally prevent most third-party software and services from loading. By disabling the EDR solution in this way, the attackers created a window of opportunity for themselves to steal data without encryption. Despite their best efforts, however, they were unable to launch the main ransomware payload (akira.exe) via AnyDesk in Safe Mode.
The failure to encrypt files was likely due to the system’s low virtual memory and resulting out-of-memory errors, which prevented the ransomware from executing successfully. However, a scheduled Defender scan eventually detected the Akira executable even with real-time protection disabled in Safe Mode. The security tool quarantined the file only after the attacker rebooted the system into normal mode, restoring real-time protection.
This incident marks the first time that Huntress has observed this tactic being used in an Akira attack, although other ransomware families such as Snatch and AvosLocker have employed similar tactics for years. The researchers recommend adding MFA to all VPN accounts, placing credential-spraying detection measures, and monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry.
This incident serves as a reminder that even with robust security measures in place, attackers can still find ways to disable EDR solutions and steal data without encryption. As the Blue Report 2026 highlights, prevention scores can hide what happens after initial access, and once attackers have valid credentials, only 37% of their actions are blocked.
To mitigate this risk, organizations should prioritize adding MFA to all VPN accounts and implementing credential-spraying detection measures. Regular monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry can also help detect potential threats early on. By taking these proactive steps, organizations can reduce their exposure to attacks like this one and stay ahead of evolving threat tactics.
Source: Bleeping Computer — 2026-08-13