Akira Hackers Disable EDR with Safe Mode, Steal Data but Fail to Encrypt

Overview

An Akira ransomware affiliate used a novel endpoint detection evasion technique to blind security tools on a compromised Windows system — rebooting the machine into Safe Mode with Networking to prevent third-party EDR and antivirus agents from loading. While the attacker successfully exfiltrated data within a five-hour window, the encryption phase failed due to low virtual memory conditions and an unexpected scheduled Defender scan, leaving the organization with stolen data but intact files.

The incident, documented by researchers at BleepingComputer, marks the first confirmed use of the Safe Mode bypass technique by an Akira affiliate, though the tactic has prior precedent with the Snatch and AvosLocker ransomware families.

Incident Timeline

The entire attack lifecycle — from initial entry to encryption attempt — completed in under five hours.

Initial Access

The attackers entered through a SonicWall VPN device with no multi-factor authentication configured. No exploit was required; the unprotected credential-based authentication allowed direct network entry. This underscores one of the most persistent and preventable failure modes in enterprise security.

Lateral Movement and Data Exfiltration

After gaining VPN access, the attackers:

1. RDP'd to the domain controller to gain administrative privileges
2. Performed Active Directory enumeration to map the environment
3. Pivoted to an application server as an exfiltration staging host
4. Used WinRAR to archive mapped file shares into compressed archives
5. Uploaded the archives to an attacker-controlled S3 bucket using s5cmd, a high-performance S3-compatible CLI tool known for its speed with large transfers
6. Installed AnyDesk for persistent remote access, registering it in the Windows Safe Mode registry keys so it survives Safe Mode reboots

Even without a successful encryption, the attackers retain leverage through the double-extortion model — the stolen data can still be published or sold.

Safe Mode EDR Bypass Technique

This is the most technically significant element of the incident:

How It Works

1. Attackers force the target system to reboot into "Safe Mode with Networking" (using bcdedit /set safeboot network or similar)
2. Windows Safe Mode loads only a minimal set of drivers and services — by default, third-party security software (EDR, AV agents) does not load unless explicitly registered as a Safe Mode service
3. The following tools were confirmed blind in this incident:
   • Huntress agent — did not load in Safe Mode
   • Microsoft Defender real-time protection — disabled in Safe Mode
4. This created an approximately 10-minute window with no functioning EDR or real-time AV
5. AnyDesk was pre-registered in Safe Mode startup to maintain attacker connectivity through the reboot cycle

Precedent

The Safe Mode bypass technique is not new — it was previously documented with Snatch ransomware (2019) and AvosLocker (2022). Its use by an Akira affiliate suggests the technique is spreading through RaaS affiliate knowledge-sharing channels.

Encryption Failure

Despite the EDR bypass succeeding, the encryption payload failed for two reasons:

1. Low virtual memory: The akira.exe ransomware payload generated out-of-memory errors and PowerShell errors during execution — the target system had insufficient virtual memory to sustain the encryption process
2. Scheduled Defender scan: Although real-time protection was disabled in Safe Mode, a scheduled Microsoft Defender scan was triggered and detected the akira.exe file. While it was not immediately quarantined in the degraded state, the file was handled once the system rebooted back into normal mode with full protections restored

The combination of resource constraints and a defense-in-depth layer (scheduled scanning) thwarted the encryption, even after the EDR bypass succeeded.

Tools Used

Defensive Takeaways

1. MFA on all VPN and remote access endpoints is non-negotiable — this attack would not have begun with MFA in place
2. Register your EDR as a Safe Mode service — check with your EDR vendor for instructions; many support this capability but it is not always enabled by default
3. Alert on bcdedit /set safeboot commands — Windows event logs and EDR process monitoring can catch this before the reboot occurs
4. Monitor for s5cmd and WinRAR use in enterprise environments — both are legitimate tools but anomalous in most contexts
5. Maintain scheduled AV scans as a defense-in-depth layer — they operate independently of real-time protection and can catch payloads even when the agent is partially disabled
6. Monitor AnyDesk installation events — unexpected remote access tool installation, especially combined with Safe Mode registry modifications, is a high-fidelity alert

References

• BleepingComputer — Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt