Ransomware crews have spent two years working out how to detonate an encryptor where the endpoint agent cannot see it. One Akira affiliate built a whole virtual machine on the victim's hypervisor for it. In an intrusion Huntress investigated in early August, an affiliate found something cheaper. They rebooted the machine into Safe Mode.
Safe Mode with Networking loads only core Windows drivers and services while keeping the network up, and third-party security products are excluded from that minimal set by design. One reboot put the Huntress agent and Windows Defender real-time protection on the floor together, and left the attacker connected.
Then it broke their ransomware.
Seven minutes from spray to a valid login
The intrusion started where Akira intrusions usually start. At about 03:45 UTC on August 4, a SonicWall SSL VPN logged a burst of failed logins against several usernames from several external addresses, a plain credential spray. Seven minutes later one of them worked, against a VPN with no multi-factor authentication in front of it. It is the appliance class CISA has flagged as an active target. Nearly two hours later the operator opened a Remote Desktop session to the domain controller.
The enumeration anyone who has met Akira knows
What followed was a full-property dump of every user and every computer in the domain, written to AdUsers.txt and AdComp.txt and read in Notepad on the domain controller. The give-away is one line setting PowerShell's format enumeration limit to -1, which strips the default truncation so every group membership lands in the file intact. WinRAR then archived the mapped file shares, s5cmd pushed them to an attacker-controlled S3 bucket, and AnyDesk went on as a Windows service for hands-on control and payload delivery.
One registry key kept their own tooling alive
At 06:29:21 UTC the operator ran msconfig.exe and forced a reboot. The host came back carrying a SAFEBOOT:NETWORK load option. Safe Mode would have killed the attacker's AnyDesk service too, so seconds earlier they had added AnyDesk to the SafeBoot network key, the short list of services Windows does start in that mode. Their tooling survived. The defenders' did not: Defender logged error 0x8007043c, "This service cannot be started in Safe Mode".
MITRE tracks this as Impair Defenses: Safe Mode Boot, and Snatch and AvosLocker have used it for years. Huntress says this is the first time it has seen Akira do it. Other crews build tooling for the same job, as The Gentlemen did with a bespoke EDR killer suite. This affiliate used a troubleshooting feature and a registry value.
The trick that starved their own encryptor
akira.exe launched at 06:34:29 and spawned its child process burst about two minutes later. Around that same moment the host began logging memory failures: virtual memory minimum too low, then out of virtual memory, then PowerShell unable to create a new guard page for the stack. Safe Mode boots with a constrained environment, and the encryptor appears to have exhausted it. A scheduled Defender scan named the binary correctly at 07:43:50, but with real-time protection dead the cleanup failed repeatedly. The only successful quarantine landed after the attacker rebooted back into normal Windows and handed Defender its protection back. Huntress is careful about what that proves, and so are we: it was a side effect of the attacker's own mistake, not a control anybody deployed, and a host with more memory might have given the payload the room it needed.
Alert on the boot, not just the binary
Watch for bursts of failed VPN logins against multiple usernames from one source, and require multi-factor authentication on every VPN account. Then alert on boot-configuration changes: msconfig and bcdedit activity, a boot carrying a SAFEBOOT load option, third-party security services stopping, and any addition to the SafeBoot minimal-service registry list. A Safe Mode reboot on a server at half past six in the morning has almost no innocent explanation. Coverage is the other half: the agent here covered a fraction of the machines the attacker had just enumerated.
Huntress published the full attack chain and indicators, with thanks to Dray Agha for the analysis. The successful VPN login came from 72[.]23[.]77[.]35 and akira.exe carries SHA-256 414b9985f46714f44dd1bd63860d2a48dcfababcfe5c712a4b4f575378127a56.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.