Akira ransomware reboots into Windows Safe Mode to knock EDR offline
Akira ransomware affiliates were seen using a new technique to evade endpoint detection and response (EDR), where they rebooted a compromised Windows system into Safe Mode with Networking enabled. According to Huntress, the technique successfully took both its agent and Microsoft Defender’s real-time protection offline. This, the researchers said, gave the attacker a window to operate without endpoint defenses. The incident investigated by Huntress began on August 4 with a credential-spraying attack against an exposed SonicWall SSL VPN. About seven minutes after the failed login attempts began, an attacker successfully authenticated to an account that did not have multi-factor authentication (MFA) enabled, Huntress analyst James Northey said in a blog post. Two hours after authentication was managed, the operator reportedly accessed the domain controller over RDP, performed extensive Active Directory enumeration, and subsequently moved to an application server to archive mapped file shares with WinRAR. The stolen data was uploaded to an attacker-controlled S3 bucket using s5cmd, establishing the data-theft component of a double-extortion attack. Ultimately, AnyDesk was installed on the host machine for persistent remote access and to deliver the Akira ransomware payload. This is when the operator used “msconfig.exe” to force the machine into Safe Mode with Networking, instead of disabling EDR directly. Huntress says this is the first time it has observed Akira using the technique. Safe Mode is becoming a popular ransomware technique Safe Mode is normally a Windows troubleshooting environment that loads only essential drivers and services. That makes it useful to attackers because many third-party security products are excluded from the minimal startup configuration. Anticipating that AnyDesk itself might also be unavailable in Safe Mode, the attackers modified the Safe Boot registry configuration to ensure the remote-access service would start. The approach is not e Vendors: Microsoft, Google, AWS, Oracle, SonicWall, Atlassian, GitHub. DORA relevance: high.