Huntress detailed an Akira ransomware intrusion that reached in through an exposed SonicWall VPN and then forced Windows into Safe Mode to disable defenses. Because Safe Mode starts only a minimal set of services, the endpoint detection tools and Microsoft Defender did not load, leaving the attacker free to run their encryptor. The twist is that Safe Mode also starves the system of virtual memory, and thirteen seconds after the reboot the encryptor ran out of memory and crashed, so files were not encrypted, though the attacker still stole data. The technique remains a useful evasion play worth detecting even when the payload fails.
Sophos has detailed a threat actor using an AI-assisted ransomware toolkit that automates Active Directory discovery and EDR evasion. Tool and payload development was aided by Cursor and Claude Opus agents across coding, analysis, and revision, with some agents tasked to scrape security-research posts for fresh bypass techniques; resulting malware was tested in VMs against Sophos, CrowdStrike, and Microsoft EDR. The framework includes Cobalt Strike profiles mimicking legitimate web traffic, a Telegram-bot C2, Python shellcode injectors preserving host-binary functionality, and a Cloudflare Worker front-end redirector. Despite the AI orchestration, the workflow is entirely human-driven. Operator logs and a ransomware-leak-site reference confirmed criminal, not red-team, use.
TrustStrike Labs