evasion
Akira Ransomware Uses Safe Mode to Bypass EDR
Akira ransomware operators attempted to bypass endpoint detection and response (EDR) by rebooting a compromised system into Safe Mode with Networking. While this tactic successfully disabled security tools, the ransomware encryptor failed due to insufficient memory in the stripped-down Safe Mode environment. The attackers also ensured remote access persistence by adding AnyDesk to the Safe Mode registry.
Malware Crypting Services Aid Threat Actors in Evading Detection
Malware crypting services are evolving beyond simple payload modification to offer comprehensive malware enablement. These services help threat actors bypass security software, complicate analysis, and maintain malware functionality even after detection. A competitive market exists, primarily focused on Windows payloads, with providers advertising on various underground and social platforms.