safe mode news

Akira Ransomware Uses Safe Mode to Bypass EDR

An Akira ransomware affiliate recently attempted to deploy ransomware on a victim's network by first rebooting the compromised host into Safe Mode with Networking, a tactic aimed at disabling endpoint detection and response (EDR) tools. While the maneuver successfully bypassed security controls, the ransomware itself failed to execute due to memory constraints within the stripped-down Safe…