Akira ransomware reboots Windows into Safe Mode to switch off security tools

Huntress detailed an Akira ransomware intrusion that reached in through an exposed SonicWall VPN and then forced Windows into Safe Mode to disable defenses. Because Safe Mode starts only a minimal set of services, the endpoint detection tools and Microsoft Defender did not load, leaving the attacker free to run their encryptor. The twist is that Safe Mode also starves the system of virtual memory, and thirteen seconds after the reboot the encryptor ran out of memory and crashed, so files were not encrypted, though the attacker still stole data. The technique remains a useful evasion play worth detecting even when the payload fails.

Check

Alert on boot-configuration changes and Safe Mode boots, watch for security services stopping and tools added to the Safe Mode service list, and require multi-factor authentication on every VPN account.

Affected

Windows environments reachable through exposed or weakly protected VPNs; an attacker who gains access can reboot endpoints into Safe Mode to bypass endpoint detection and Defender before attempting encryption or theft.

Fix

Require multi-factor authentication on VPNs and alert on failed login bursts, monitor for msconfig and bcdedit changes and Safe Mode boot events, and run security tooling in Safe Mode where supported.