A recent Akira ransomware attack has highlighted a concerning tactic used by hackers to disable endpoint detection and response (EDR) solutions, allowing them to steal sensitive data without even attempting to encrypt it. The attackers exploited an exposed SonicWall VPN device without multi-factor authentication (MFA) to gain initial access to the compromised system.
Within just two hours of gaining access, the hacker connected to the domain controller via remote desktop protocol (RDP), enumerated Active Directory users and computers, and then moved to an application server. They used specialized tools like WinRAR and s5cmd to archive and upload stolen data to an attacker-controlled Amazon Web Services (AWS) S3 bucket. The attackers also installed AnyDesk for remote access, which they later used to force the compromised host into Safe Mode with Networking.
Safe Mode is a Windows startup state designed for troubleshooting and diagnostic operations, where only essential drivers and services are loaded, preventing most third-party software and services from running. In this mode, the EDR solution was effectively disabled, allowing the attackers to move undetected. The hackers added AnyDesk to the Safe Mode registry, ensuring their remote access remained intact even after a reboot.
However, when they attempted to launch the main ransomware payload in Safe Mode, it failed due to low virtual memory and generated errors. Meanwhile, Microsoft Defender’s real-time protection was blinded, but a scheduled scan eventually detected the Akira executable – although it couldn’t remove it while the system remained in Safe Mode. It wasn’t until the attacker rebooted into normal mode that real-time protection was restored, allowing Defender to quarantine the file.
The attackers still managed to steal credentials and files for data extortion within just five hours of initial access, despite failing to encrypt them. This incident marks the first time Huntress has observed this tactic in an Akira attack, although other ransomware families like Snatch and AvosLocker have used similar methods for years.
This attack serves as a reminder that once attackers gain valid credentials, prevention measures become significantly less effective. In fact, research suggests that only 37% of their actions are blocked after initial access. To mitigate such risks, it’s essential to implement multi-factor authentication on all VPN accounts and monitor for suspicious activity, including changes to Safe Mode boot configuration or the addition of remote-access tools to the Safe Mode service registry.
As cybersecurity professionals, we must be aware that even with robust prevention measures in place, attackers can still find ways to bypass them. By staying vigilant and monitoring our systems closely, we can reduce the likelihood of such attacks succeeding – and prevent sensitive data from being compromised.
Source: Bleeping Computer — 2026-08-13