Affiliates of the Akira ransomware have recently begun employing a distinctive method to bypass endpoint detection and response (EDR) solutions. By rebooting compromised Windows systems into Safe Mode with Networking enabled, attackers effectively disabled both their own tools and Microsoft Defender’s real-time protection. This maneuver provided attackers with an opportunity to operate without any defenses in place, highlighting the ongoing evolution of ransomware tactics.
A Credential-Spraying Attack: The Initial Breach
The incident under scrutiny started on August 4 when an adversary launched a credential-spraying attack against a vulnerable SonicWall SSL VPN. This type of attack exploits weak password practices, often leading to unauthorized access without needing sophisticated methodologies. Just seven minutes after initiating failed login attempts, the hacker succeeded in authenticating an account that lacked multi-factor authentication, as detailed by Huntress analyst James Northey in a recent blog entry.
Following successful authentication, the operator accessed the domain controller using Remote Desktop Protocol (RDP) two hours later. Once inside, they performed extensive enumeration of Active Directory, revealing the depth of their reconnaissance. Here’s the thing: the speed at which the attacker moved through the network signifies a lack of effective monitoring and response protocols. With mapped file shares then archived using WinRAR on the application server, the stolen data was subsequently uploaded to an attacker-controlled S3 bucket, establishing the double-extortion method of attack. This tactic has garnered attention as it not only encrypts data but also threatens to publish sensitive information if ransom demands aren’t met.
Strategic Evasion Tactics via Safe Mode
To maintain remote access and deliver the Akira ransomware payload, AnyDesk was installed on the compromised system. In a strategic twist, the attacker used “msconfig.exe” to reboot the system into Safe Mode with Networking rather than directly disabling EDR tools. This choice indicates a sophistication that is increasingly seen within criminal groups who aim to refine their methodologies for evading detection.
Safe Mode: An Ascending Trend in Ransomware Tactics
Safe Mode serves a specific purpose in Windows—it loads only essential services, often leaving third-party security products behind. This lack of full system support has proven useful for attackers who capitalize on its limited functionality. Recognizing that AnyDesk could potentially be absent in Safe Mode, the attackers altered the Safe Boot registry configuration to ensure the remote access service launched during this environment. This kind of adaptation shows a significant understanding of how systems operate, which makes countermeasures all the more challenging.
This approach isn’t entirely novel; several other ransomware families, like Snatch and AvosLocker, have previously employed similar tactics to neutralize defenses. The MITRE ATT&CK framework classifies this behavior under technique T1688, designated as “Impair Defenses: Safe Mode Boot.” The adoption of this technique by Akira aligns with its ongoing drive to circumvent EDR coverage and adapt to existing security measures.
Outcome of the Anti-EDR Maneuver
However, the attackers faced unexpected challenges. After launching “akira.exe” in Safe Mode, the system began displaying virtual memory errors, including “Virtual Memory Minimum Too Low” and “Out of Virtual Memory” notifications, along with PowerShell execution failures. The ransomware thus struggled to function effectively in the constrained environment of Safe Mode, exposing an inherent risk in their strategy; if systems are pushed to operate outside their limits, it can lead to operational issues for the malware itself.
Although Defender eventually identified the Akira binary, it was unable to remediate the situation while real-time protection was disabled. The threat was quarantined only after the system was rebooted into normal Windows operation, restoring Defender's functionality. This incident highlights a crucial aspect of ransomware strategy—attacks often rely on a series of coordinated maneuvers, and a single failure point can disrupt their plans. But that doesn’t mean organizations should rest easy.
Despite the temporary halt in encryption, Huntress cautions that the failure should not be overly celebrated. It likely stems from Akira’s significant resource needs rather than a reliable security measure. Future versions of Akira could very well adapt to function properly in Safe Mode, with adjustments to memory requirements or page file settings. This illustrates a stark reality—threat actors are always iterating. What you’ve seen today may not be what you encounter tomorrow.
Proactive Measures and Future Outlook
As a proactive measure, organizations should focus on detection mechanisms before a system reboot. Huntress recommends enforcing multi-factor authentication on every VPN account, which can dramatically reduce the risk of credential-spraying attacks, as seen in this incident. Monitoring for patterns in failed login attempts leading to successful authentications can also offer critical insights that may preempt attacks. Deploying EDR across all host environments is vital, but so is vigilance over Security Information and Event Management (SIEM) logs for any activity related to “msconfig.exe”, Safe Mode boot events, and modifications to the Safe Boot registry.
If you're working in this space, you'll understand that waiting for the next attack is not an option. Cybercriminals adapt rapidly, and the systems meant to protect us must evolve just as quickly. As ransomware groups like Akira refine their methods, the security community must develop new defenses. After all, adapting to these threats isn't just prudent—it’s necessary for survival in a digital environment filled with risks.
