An Akira ransomware affiliate inadvertently sabotaged their own encryption efforts by rebooting a victim's machine into Safe Mode with Networking, a tactic intended to disable security software. The limited system resources available in Safe Mode, particularly constrained virtual memory, caused the Akira encryptor to fail, preventing it from locking the victim's files.
The incident, detailed by Huntress security operations analysts, highlights a potential vulnerability in Akira's design. The encryptor, `akira.exe`, is engineered for speed, utilizing concurrent worker threads and extensive memory mapping. This high-performance architecture likely strained the minimal driver set and restricted pagefile availability in Safe Mode, leading to memory errors and preventing successful encryption.
Despite this operational blunder, the attacker had already achieved significant compromise before the encryption failure. The intrusion began in early August with a credential-spray attack against a SonicWall SSL VPN. On August 4, after several failed login attempts, the attacker successfully authenticated using a valid VPN account that lacked multi-factor authentication (MFA).
Upon gaining initial access, the threat actor moved to the domain controller via Remote Desktop Protocol (RDP) and performed extensive enumeration of the Active Directory. This involved a full-property dump of all users and computers within the domain, providing critical information for lateral movement and targeting.
The attacker then proceeded to an application server to exfiltrate data. They downloaded WinRAR to archive mapped file shares and used `s5cmd`, a fast S3 transfer utility, to send the stolen data to cloud storage. Additionally, the legitimate remote desktop software AnyDesk was installed and configured for persistence, effectively functioning as a remote access trojan and a command-and-control channel for deploying further malware, including the `akira.exe` ransomware binary.
Approximately three hours into the intrusion, the attacker initiated the reboot into Safe Mode with Networking. This technique, previously observed with other ransomware families like Snatch and AvosLocker but new to Akira operations, aims to disable endpoint detection and response (EDR) products and other security tools. In this instance, the reboot successfully stopped the Huntress agent and disabled Microsoft Defender's real-time protection.
However, thirteen seconds after the reboot, the system began reporting memory errors. Safe Mode's constrained virtual memory environment proved insufficient for the `akira.exe` encryptor to function correctly, leading to its failure. This effectively turned the attacker's attempt to bypass security into a self-inflicted denial of service for their own malware.
While this specific failure prevented file encryption, security experts caution against viewing it as a reliable defense mechanism. The attacker had already exfiltrated credentials and data, representing a significant breach. Furthermore, a system with more physical memory or a larger page file might still allow `akira.exe` to encrypt in Safe Mode. Akira's developers or affiliates could also retool the encryptor to reduce its memory demands or improve its reliability in Safe Mode, potentially preventing similar failures in future intrusions.
The incident underscores the critical importance of multi-factor authentication for all VPN accounts and the need for organizations to monitor for credential-spray attacks. Huntress also recommends vigilance for boot-configuration changes and Safe Mode boots, specifically looking for `msconfig.exe` or `bcdedit` activity, Kernel-Boot Event ID 27 with a SAFEBOOT load option, Kernel-General Event ID 12 with BootMode=2, and the stopping of third-party security services (System Event ID 7036). Monitoring for tooling added to the Safe Mode minimal-service registry list is also advised.
