Akira: Intrusion Stopping EDR via Safe Mode and Exfiltrating Data Before Encryption

1. Basic Information

• Severity: High
• Article Title: Akira Hits Safe Mode: Ransomware Rebooting Around EDR
• Publisher: Huntress
• Publication Date: 2026-08-13
• Original Article: https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
• Related Sources: https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/
• Related Entities: Akira, SonicWall SSL VPN, Active Directory, WinRAR, s5cmd, Amazon S3, AnyDesk, Microsoft Defender, Windows Safe Mode

2. Executive Summary

This is a case where Akira attackers accessed a network via an SSL VPN without MFA. They enumerated Active Directory, compressed and exfiltrated shared data to Amazon S3, and installed AnyDesk for persistence. They then rebooted the system into Safe Mode with Networking to stop EDR. However, the ransomware failed to encrypt files due to low virtual memory.

3. Attack Flow

1. After many failed login attempts against a SonicWall SSL VPN, authentication succeeds on 2026-08-04 at 03:52:42 UTC.
2. About two hours later, the attackers RDP into the domain controller and run an elevated cmd.exe.
3. They use PowerShell commands (Get-ADUser and Get-ADComputer) to list users and computers, saving the output to C:\ProgramData.
4. On an application server, they use WinRAR to archive files from mapped network shares.
5. They use s5cmd cp --sp to send the archives to an attacker-controlled S3 bucket.
6. They install AnyDesk as a service for automatic startup to enable remote sessions, file transfers, and clipboard transfers.
7. They configure Safe Mode with Networking and add the AnyDesk service to the registry for SafeBoot.
8. After a reboot, they run akira.exe while Huntress and Defender real-time protection are not running.
9. After 13 seconds, a low virtual memory error occurs, and the encryption process fails.
10. After returning to normal mode, Defender isolates Akira. Data theft was completed before the encryption failed.

4. Attacker Positioning and Execution Locations

• Initial access happened through an internet-facing SonicWall SSL VPN.
• AD enumeration ran on the domain controller. Compression and exfiltration ran on the application server.
• AnyDesk and Akira ran on Windows hosts. The S3 bucket and AnyDesk infrastructure are external.
• Public reports do not explain additional privilege escalation methods. The use of an elevated shell was confirmed, but the path to obtain those privileges is unknown.

5. Visibility for Victims and Administrators

• The VPN logs show many short-lived failed logins followed immediately by a successful login.
• Administrators can see RDP connections, bulk AD enumeration, WinRAR, s5cmd, AnyDesk service registration, and Safe Mode reboots.
• During Safe Mode, normal EDR and Defender monitoring stops. Defender Event ID 3002 records the startup failure.
• Even without encrypted files or ransom notes, compression and outbound transfers mean data theft has occurred.

6. Success and Failure Conditions

Success Conditions

• Valid credentials are used on a VPN without MFA.
• RDP or administrative access is available from the VPN to the domain controller and application servers.
• Reading shared data and running WinRAR, s5cmd, and AnyDesk are allowed.
• The attacker has administrative rights to change SafeBoot settings and reboot.
• Communication with external S3 buckets and AnyDesk is allowed.

Failure Conditions

• VPN MFA, blocking failed login spikes, or risk-based authentication blocks access.
• Network segmentation or RDP limits stop lateral movement.
• Large-scale compression, S3 transfers, and AnyDesk installations are detected and isolated.
• SafeBoot changes and Safe Mode reboots are blocked with high priority.
• In this case, Akira ran out of virtual memory and failed to encrypt files.

7. What Happens on Success

Shared data is exfiltrated to the attacker's S3 bucket and can be used for double extortion. The attackers stop security products using Safe Mode and aim to encrypt files with Akira. In this case, data theft succeeded, but file encryption was not confirmed.

8. Observable Logs

• Email: Public reports show no email vector.
• Proxy/SWG/DNS: Traffic to external S3, AnyDesk, and attacker IP addresses. S3 object upload volume and timestamps.
• Endpoint/EDR: Get-ADUser, Get-ADComputer, WinRAR, s5cmd, AnyDesk, msconfig.exe, SafeBoot registry keys, akira.exe, and virtual memory errors.
• Identity/IdP: SonicWall VPN failed and successful logins, RDP logons, and privileged logons.
• SaaS/Cloud: PUT or multipart uploads to the attacker's S3 bucket. If CloudTrail is missing on the victim side, proxy or network logs must cover this.
• Network: VPN source IP 72.23.77.35, internal RDP, SMB share access, AnyDesk, and S3 egress.

9. Attack Success Assessment

• Contact Only: VPN failure logs only.
• Successful Authentication: VPN success and session issuance at 03:52:42 UTC.
• Initial Execution: Internal RDP and enumeration commands confirmed.
• Information Gathering: WinRAR archive creation of shared data.
• Data Exfiltration: Confirmed via s5cmd success, S3 transfer volume, or destination objects.
• Defense Evasion: Safe Mode startup and EDR/Defender stop confirmed.
• Encryption: Failed in this case. No encrypted files or success logs.

10. Investigation Playbook

• Trigger: VPN failure spike followed by success, SafeBoot changes, AnyDesk installation, s5cmd, and Akira detection.
• Initial Check: Identify VPN sessions, source IP, authenticated user, destination, and the first RDP timestamp.
• Endpoints: Preserve PowerShell logs, processes, registry keys, services, Kernel-Boot Event ID 27, Kernel-General Event ID 12, and Defender Event ID 3002.
• Authentication & Cloud: Disable VPN credentials, check for RDP and administrative logons using the same ID, and review S3 traffic.
• Subsequent Activity: Search for AdUsers.txt, AdComp.txt, WinRAR archives, s5cmd logs, AnyDesk transfers, and Akira binaries.
• Containment: Disconnect VPN sessions, change credentials, isolate hosts, remove AnyDesk and SafeBoot persistence, block egress, and run a full scan in normal mode.
• Assessment Categories: VPN Contact / VPN Compromised / Internal Execution / Exfiltration Confirmed / Defense Evasion Confirmed / Encryption Failed or Confirmed.

11. Defense and Detection Ideas

• Single Event: SafeBoot registry changes, SAFEBOOT:NETWORK, AnyDesk SafeBoot service, s5cmd, and Defender error 0x8007043c.
• Time-Series Correlation: VPN failure spike -> success -> RDP -> AD enumeration -> compression -> S3 transfer -> AnyDesk -> Safe Mode -> Akira.
• Hunting: C:\ProgramData\AdUsers.txt and AdComp.txt, WinRAR commands with multiple share arguments, unknown S3 buckets, and AnyDesk peer 1778787240.
• Log Gaps: Must cover VPN, RDP, process arguments, SMB, egress, and the lack of monitoring during Safe Mode.
• Priority Mitigations: VPN MFA, administrative network segmentation, blocking SafeBoot changes, RMM allowlists, S3 egress controls, and EDR tamper protection.

12. Facts / Inference / Hypothesis

Facts

• Successful authentication was confirmed on a SonicWall SSL VPN without MFA.
• AD enumeration, shared data compression, S3 transfer via s5cmd, and AnyDesk installation were confirmed.
• Huntress and Defender real-time protection did not run during Safe Mode.
• Akira ran out of memory and failed to encrypt files.
• This was the first time Huntress observed Akira using Safe Mode.

Inference

• Even if encryption fails, extortion risks remain using the stolen data.
• Visibility during Safe Mode is poor, so security teams must correlate pre-reboot settings changes with post-reboot forensic artifacts.

Hypothesis

• On hosts with more virtual memory, the same Akira binary might complete encryption.

13. MITRE ATT&CK Mapping

• High Confidence: T1133 External Remote Services, T1078 Valid Accounts, T1021.001 RDP, T1087.002 Domain Account Discovery, T1018 Remote System Discovery, T1560.001 Archive via Utility, T1537 Transfer Data to Cloud Account, T1219 Remote Access Software, T1562.001 Impair Defenses, T1486 Data Encrypted for Impact (execution attempted, not successful).
• Medium Confidence: T1041 Exfiltration Over C2 Channel. Because of the S3 transfer, organizations may prioritize T1537 based on their ATT&CK framework usage.

14. Unknowns and Further Investigation

• The source of the VPN credentials and the path to elevated privileges.
• The full scope of exfiltrated data and how it is used.
• The number of compromised hosts, additional persistence mechanisms, and the full infrastructure of the Akira operators.
• Whether the encryption failure was environment-dependent or binary-specific.

15. Impact on SOCs

Tools like VPNs, RDP, AnyDesk, and WinRAR are common in enterprise environments, making isolated events easy to miss. Safe Mode reboots should not be assumed to be routine maintenance. Security teams should treat enumeration, compression, S3 transfers, and reboots occurring within hours of external VPN authentication as a single malicious intrusion flow.

16. Summary by Target Audience

• For SOCs: Distinguish between file encryption success and data theft success, and correlate forensic evidence before and after Safe Mode.
• For Administrators: Enforce VPN MFA, isolate RDP access, monitor SafeBoot changes, and maintain strict allowlists for RMM tools and cloud destinations.
• For Users: Immediately report unexpected VPN authentication notifications or unexpected remote desktop activity.