Akira disables EDR by rebooting into Safe Mode before exfiltrating data

August 4, 2026. An Akira ransomware affiliate gains initial access through an exposed SonicWall VPN with no MFA. Two hours later. They reach the domain controller over RDP and enumerate Active Directory accounts. Under five hours after initial access. The data is exfiltrated — while encryption, as it turns out, narrowly failed.

That is the account published on August 13, 2026 by Huntress, the MDR vendor that detected and followed the intrusion. Its lesson reaches beyond Akira: an EDR is no safety net once an attacker holds valid credentials and can decide, on their own, which mode the machine boots into.

Initial access: an exposed VPN, minus MFA

Everything starts with a SonicWall VPN firewall reachable from the internet and not protected by multi-factor authentication. That single link unlocked the rest. Roughly two hours after a successful VPN login, the attacker opened an RDP session on the domain controller, enumerated the directory’s users and machines, then pivoted to an application server.

There, they archived mapped network shares with WinRAR and used the s5cmd tool to upload the archives to an S3 bucket they controlled. Finally, they installed AnyDesk to keep a persistent remote foothold — the exit door as much as the entry.

Safe Mode, the EDR blind spot

The next step is what makes the Huntress report worth reading. Through AnyDesk, the attacker forced the compromised host to reboot into Safe Mode with Networking. This Windows startup state, built for diagnostics, loads only a reduced set of drivers and services: most third-party software never starts. In this case, the Huntress agent and Microsoft Defender’s real-time protection both went dark.

“For 10 minutes while in Safe Mode, the host had no working EDR, and AV was blinded,” Huntress summarizes. The attacker used that window to register AnyDesk in the Safe Mode registry, so the remote-access tool would survive the reboot and keep their hands on the machine.

The detail matters for defenders: the EDR bypass required no exploit, no process kill, no signed driver. Just a boot-state change — an administrative gesture most telemetry does not watch for.

An old trick that crosses ransomware families

Rebooting into Safe Mode to neutralize defenses is not an Akira invention. Snatch popularized it back in 2019 by registering its binary in the Safe Mode registry so it would run in place of security agents; AvosLocker followed, then other families such as BlackByte and Medusa shipped variants. Huntress notes this is the first time it has observed the tactic in Akira, which says a lot about how porous groups are: TTPs never stay the property of one family for long.

The mechanics are always the same: Windows in Safe Mode with Networking loads a minimal kernel, a reduced set of drivers and services, and skips most third-party EDR agents — they simply never start. The attacker does not need to kill the agent process; they only need to make sure the machine never starts it.

Why encryption failed, and why that changes nothing

The story ends in a half-victory for the defense. When the attacker tried to launch the akira.exe payload through AnyDesk from Safe Mode, it failed: the machine reported low virtual memory and threw PowerShell and out-of-memory errors.

A scheduled Defender scan eventually caught the Akira executable even without real-time protection, but could not remove it while the machine stayed in Safe Mode. The file was only quarantined after a reboot into normal mode restored real-time protection.

The trap would be to call this a win. Akira failed to encrypt, but the operator still exfiltrated credentials and files in under five hours — enough to run a classic extortion. Encryption is one lever among several; exfiltration was already in the bag.

Huntress notes that families like Snatch and AvosLocker have used this tactic for years, but this marks the first time the lab observed it in an Akira attack — a sign the technique is spreading beyond its originators.

The most alarming detail is not the payload but the speed. Under five hours separated the initial VPN login from complete exfiltration — barely enough time to detect, and none to respond within working hours. Against an attacker holding valid credentials, the action window is measured in minutes, not days. Detection must therefore target states — the flip into Safe Mode, a remote-access tool added to the registry — rather than the malware itself.

What Safe Mode loads, and what it omits

Windows Safe Mode boots a kernel and drivers limited to the bare minimum, disables most non-critical services, and skips third-party startup programs. The “with Networking” variant adds the network stack — which lets the attacker keep AnyDesk alive and exfiltrate — without re-enabling Defender’s real-time protection, which stays off until the machine returns to normal mode.

That mismatch is what traps teams: the machine is reachable, the attacker is working, but the EDR telemetry is silent because the agent is not loaded. A SOC that trusts the mere presence of the agent will wrongly conclude “everything is fine” — while exfiltration continues.

What to monitor, concretely

The evasion is detectable if you look at the right layer. Huntress recommends three signals: MFA on every VPN account (the upstream fix), credential-spraying detection (the precursor to valid-credential abuse), and telemetry on boot-state changes — specifically, machines rebooting into Safe Mode and remote-access tools registered in the Safe Mode registry.

Each signal is cheap to collect. Windows logs Safe Mode boots as a distinct startup event, and the registry key governing what runs in Safe Mode is well documented. The problem is not that the data is missing — it is that most deployments never alert on it, because it sits outside the malware-focused rules most teams maintain.

Verdict

The control that would have stopped this sits upstream of the EDR: enforce MFA on every VPN account, no exceptions. An exposed VPN firewall without multi-factor is an invitation — precisely the entry scenario described here.

Second, watch the evasion itself, not just the malware. Detect boot-configuration changes (a flip into Safe Mode) and the addition of remote-access tools to the Safe Mode registry. Both are low-noise signals, but they land moments before the destructive act.

The underlying signal is simple: an EDR protects a machine as it boots normally. Once an attacker holds credentials and can choose the boot mode, the protection empties out. Defense therefore lives in access prevention and state-change detection — not in faith in the agent.

Finally, shrink the blast radius. Segment the network so a single compromised workstation cannot reach the domain controller and every file share over RDP. The attacker moved from VPN to domain controller to application server in under two hours because nothing slowed them down — lateral movement is where dwell time is won or lost, and it is the cheapest place to buy back time for your defenders.

References

• BleepingComputer — Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt, August 13, 2026
• Huntress — incident report cited by BleepingComputer, accessed August 16, 2026