An Akira ransomware affiliate recently exploited a SonicWall VPN device lacking multi-factor authentication (MFA) to gain initial access to a target system, subsequently disabling endpoint detection and response (EDR) solutions by booting the machine into Safe Mode with Networking. This incident, which occurred on August 4, marks the first time this specific tactic has been observed in an Akira attack, though other ransomware groups like Snatch and AvosLocker have employed similar methods for years.
The attack unfolded rapidly, with the threat actor connecting to the domain controller via RDP approximately two hours after the initial VPN login. From there, they enumerated Active Directory users and computers before moving to an application server. The attackers then used WinRAR to archive mapped file shares and the s5cmd command-line tool to exfiltrate the stolen data to an attacker-controlled S3 bucket. Following data theft, AnyDesk was installed for persistent remote access.
Crucially, the attackers utilized AnyDesk to force the compromised host into Safe Mode with Networking. This action effectively disabled both the Huntress agent and Microsoft Defender's real-time protection, leaving the system vulnerable for about ten minutes without active EDR or antivirus defenses. Safe Mode, a diagnostic Windows startup state, loads only a limited set of drivers and services, preventing most third-party security software from running. During this window, AnyDesk was added to the Windows Safe Mode registry to maintain remote access after a reboot.
Despite successfully disabling security measures and stealing data, the attackers' attempt to deploy the Akira ransomware payload (akira.exe) failed. When launched via AnyDesk in Safe Mode, the executable encountered "out-of-memory" and PowerShell errors, with the system reporting low virtual memory.
Although real-time protection was disabled, a scheduled Microsoft Defender scan eventually detected the Akira executable. However, Defender was unable to remove the file while the machine remained in Safe Mode. The file was only quarantined after the attacker rebooted the system into normal mode, which restored Defender's real-time protection.
In total, the entire operation, from initial access to the failed encryption attempt, spanned less than five hours. Despite the encryption failure, the Akira operator successfully exfiltrated credentials and files, setting the stage for potential data extortion.
Security researchers recommend implementing MFA for all VPN accounts, deploying credential-spraying detection measures, and monitoring for changes to Safe Mode boot configurations or the addition of remote-access tools to the Safe Mode service registry to mitigate such threats.
