An Akira ransomware affiliate pulled off a rarely-seen technique during an August 4 intrusion: instead of trying to kill the victim’s endpoint detection and response (EDR) software head-on, they simply rebooted the compromised machine into Windows Safe Mode. Safe Mode loads only a minimal set of drivers and explicitly prevents most third-party services — including security agents — from starting. With the EDR neutralized, the attacker disabled Microsoft Defender’s real-time protection as well, giving themselves free run of the system.
The attack was documented by Huntress, a managed detection and response (MDR) company whose own agent was among those silenced. Initial access came through an exposed SonicWall VPN appliance with no multi-factor authentication enabled. From there the attacker spent roughly two hours moving laterally: enumerating Active Directory via the domain controller, archiving file shares with WinRAR, and exfiltrating the data to an attacker-controlled Amazon S3 bucket using the s5cmd command-line tool. They installed AnyDesk as a persistent remote-access foothold before triggering the Safe Mode reboot through AnyDesk itself. In the end, the encryption stage never completed — the MDR response team caught the operation in progress — but the data had already left the network.
The tactic is a reminder that EDR software is only as effective as the environment that keeps it running. Defenders should audit whether their security agents are configured to start in Safe Mode, restrict VPN access behind MFA, and monitor for unusual reboots during off-hours.