A recent ransomware attack by an affiliate of the Akira group reportedly failed to encrypt a victim's files after the attacker's attempt to disable security tools backfired. The incident, which occurred in early August, involved the attacker rebooting the victim's system into Safe Mode, a tactic that ultimately prevented the ransomware payload from executing successfully.
According to analysis by Huntress, a managed security specialist, the attack began with a credential spraying attempt against a SonicWall SSL VPN lacking multifactor authentication. This provided initial access, after which the threat actor used Remote Desktop Protocol (RDP) to reach the domain controller and perform Active Directory enumeration, a common step in Akira operations.
The attacker then moved to an application server to exfiltrate files, transferring them to cloud storage using the s5cmd utility. This "double extortion" strategy involves stealing sensitive data before encryption, with the threat of public release if a ransom is not paid.
However, the attack deviated from typical Akira methods when the threat actor ran `msconfig.exe` to force a reboot into "Safe Mode with Networking" before deploying the ransomware. This technique, listed as MITRE ATT&CK T1688 ("Impair Defences: Safe Mode Boot"), is designed to disable third-party security services, including Endpoint Detection and Response (EDR) agents and real-time antivirus protection. While not previously observed with Akira, groups like Snatch and AvosLocker have employed it for years.
In this instance, the Safe Mode boot inadvertently caused host memory errors. Huntress reported that the stripped-down environment and constrained virtual memory in Safe Mode led to the Akira process tree consuming too many resources, resulting in "Out of Virtual Memory" pop-ups and PowerShell errors that coincided with the ransomware payload's attempted execution. This effectively sabotaged the encryption phase of the attack.
While the incident resulted in a fortunate outcome for the victim, Huntress cautioned that this was an accidental side effect rather than a reliable defense. Future Akira attacks might succeed if the target system has more physical memory or a larger page file, or if the ransomware developers or affiliates retool the encryptor to reduce its memory demands or improve its Safe Mode launch sequence.
Organizations are advised to implement several security measures to defend against such attacks. These include blocking credential spraying by alerting on bursts of failed VPN logins, correlating failed attempts with subsequent successful logins from the same IP, and deploying multifactor authentication on all VPN accounts. If compromised, all Active Directory and VPN credentials should be rotated.
Furthermore, EDR should be deployed on every host, and Security Information and Event Management (SIEM) systems should ingest VPN and Windows Event Logs to provide early warnings. Organizations should also monitor for the "Safe Mode play" by flagging `msconfig.exe` or `bcdedit` activity, specific Kernel-Boot and Kernel-General event IDs indicating Safe Mode, and the stopping of third-party security services, as well as any tooling added to the Safe Mode minimal-service registry list.
