Akira ransomware affiliates were observed forcing compromised Windows systems into Safe Mode to disable endpoint detection and response (EDR) tools, according to cybersecurity firm Huntress.
In an investigation of an incident that began on August 4, Huntress analysts found that attackers launched a credential-spraying campaign against an exposed SonicWall SSL VPN. Within seven minutes, an attacker successfully authenticated to an account lacking multi-factor authentication (MFA).
From VPN Breach to Domain Controller
Two hours after initial access, the operator moved to the domain controller over RDP and performed extensive Active Directory enumeration. The attacker then pivoted to an application server, archiving mapped file shares with WinRAR before exfiltrating stolen data to an attacker-controlled S3 bucket using the s5cmd tool, establishing the data-theft component of a double-extortion scheme.
AnyDesk remote access software was installed for persistent access and to deliver the Akira ransomware payload. At this stage, the operator used msconfig.exe to force the machine into Safe Mode with Networking enabled, a Windows troubleshooting environment that loads only essential drivers and services.
Double-Edged Tactic
The technique successfully took both Huntress’s agent and Microsoft Defender’s real-time protection offline, giving the attacker a window to operate without endpoint defenses. Anticipating that AnyDesk itself might not be available in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start.
However, the tactic proved to be a double-edged sword. Huntress noted that the Safe Mode reboot also disrupted the ransomware’s own encryption process, as many of the services required for file encryption were similarly disabled by the minimal startup configuration.
Huntress said this was the first time it had observed Akira using the Safe Mode technique, though BlackLotus rootkit operators have employed similar methods to bypass Windows security features. The firm urged organizations to enforce MFA on all VPN accounts and limit remote access to only essential personnel.
Sources: CSO Online; Huntress blog; BleepingComputer
discussion