Critical cybersecurity update: Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor. NetworkFix reviewed the available source material to summarize the security issue, its potential impact and the defensive actions administrators should prioritize.
What Happened
Akira ransomware has added a new way to weaken Windows security before it tries to lock files. In a recent intrusion, an affiliate rebooted a compromised system into Safe Mode with Networking, leaving the device connected while most third-party protections stayed offline. The operation began with a credential-spraying attack against an exposed SonicWall SSL VPN […] The post Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor appeared first on Cyber Security News . Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor Akira ransomware has added a new way to weaken Windows security before it tries to lock files. The operation began with a credential-spraying attack against an exposed SonicWall SSL VPN that had no multi-factor authentication. This route echoes the risks described in recent SonicWall VPN exploitation cases. The attackers had already established a familiar, fast-moving playbook: entry through remote access infrastructure, rapid discovery of valuable systems, data theft, and then an encryption attempt within hours. Huntress said in a report shared with Cyber Security News (CSN) that it identified this as its first observed Akira case using Safe Mode to impair endpoint detection and response tools.
Technical Details
The finding matters because the group was the most active ransomware operation the researchers tracked in 2025, and even a failed encryption attempt can leave stolen data available for extortion. The files gave the attacker account names, group memberships, system information and other useful data for moving through the network. Before launching the encryptor, the intruder installed AnyDesk as a service for remote control and file transfer. It gave the attacker a temporary blind spot, while the specially enabled remote-access service preserved hands-on control. The method resembles EDR-killer attacks through SSLVPN , but this case relied on Windows startup behavior rather than a malicious driver. Safe Mode abuse is not new among ransomware groups, but its appearance in an Akira intrusion expands the ways defenders must think about endpoint coverage. Security teams should treat unexpected boot-configuration changes, Safe Mode boot events, and security services stopping together as a high-priority warning, especially after unusual VPN login activity. Akira’s payload started at 06:34 UTC, but the system soon logged virtual-memory errors, followed by PowerShell failures. Researchers concluded that the stripped-down Safe Mode environment appears to have left the ransomware process without enough available virtual memory, preventing encryption from taking hold.
Security Impact
Organizations using the affected technology should treat the report according to its critical severity classification. SonicWall log showing the spray (msg 33) resolving into a successful SSL VPN login (msg 1080) (Source – Huntress) The cleanup succeeded only after the attacker rebooted into normal Windows at 08:10 UTC, restoring real-time protection. That outcome was fortunate, not dependable: a machine with more memory or an adjusted payload could still encrypt data. Credentials and file shares had already been taken, creating leverage for a double-extortion demand. Organizations should require MFA for every VPN account, restrict or temporarily disable exposed SSL VPN access during an active incident, rotate Active Directory and VPN credentials after compromise, and centralize VPN and Windows logs in a SIEM. These steps complement lessons from SonicWall firewall ransomware activity and help defenders spot an intrusion before data theft or encryption begins. Type Indicator Description IPv4 address 72.23.77[.]35 External source IP for the successful SSL VPN login used for initial access Hostname WIN-DNCVG09TAT8 Attacker-controlled workgroup jump-host seen in RDP and logon events File paths C:\ProgramData\AdUsers.txt , C:\ProgramData\AdComp.txt Active Directory enumeration output Command WinRAR.exe a -ep1 -scul -r0 -iext -imon1 … Command used to archive file shares Command s5cmd cp –sp " " s3:// / Command used for exfiltration to an attacker-controlled S3 bucket File and SHA-256 S5cmd.exe e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a S3 exfiltration tool detected as HackTool:Win32/SSCmd!dha File and SHA-256 akira.exe 414b9985f46714f44dd1bd63860d2a48dcfababcfe5c712a4b4f575378127a56 Akira ransomware payload AnyDesk Client ID 1778787240 Remote operator peer that transferred the payload Windows event indicators Kernel-Boot EID 27 SAFEBOOT:NETWORK Kernel-General EID 12 BootMode=2 Windows events indicating a Safe Mode with Networking boot Process and behavior msconfig.exe boot-configuration change → reboot Safe Mode boot behavior associated with defense impairment Note: IP addresses and domains are intentionally defanged (e.g., [.] ) to prevent accidental resolution or hyperlinking. Stop new phishing & malware before they compromise your business.
Recommended Actions
- Identify whether the affected product, service or software is present in the environment.
- Review the original vendor or research advisory and verify affected versions before making configuration changes.
- Apply vendor-provided security updates or mitigations as soon as operationally practical.
- Review relevant security logs and monitoring alerts for signs of suspicious activity associated with the reported issue.
- Use the CVE identifiers, where available, to validate exposure through vulnerability-management and asset-inventory tools.
Security Details
- Severity: Critical
- Original source: Cybersecurity News
Why This Matters
Cybersecurity teams should use reports like this as an input to risk-based vulnerability and threat management rather than relying on headline severity alone. Exposure depends on whether the affected technology is deployed, reachable by an attacker and protected by compensating controls. Confirming asset ownership, affected versions and available vendor fixes helps teams prioritize remediation while avoiding unnecessary emergency changes.
Original Report
NetworkFix recommends reviewing the complete original report from Cybersecurity News for the authoritative technical context, affected versions, indicators and vendor-specific remediation details: Read the original report.
