--- title: Akira hackers disable EDR with Safe Mode, steal data but... description: An Akira ransomware affiliate breached a network through an exposed SonicWall VPN device lacking MFA, then forced the compromised host into Windows Safe Mode... canonical: https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt | daily.dev og:description: An Akira ransomware affiliate breached a network through an exposed SonicWall VPN device lacking MFA, then forced the compromised host into Windows Safe Mode... og:url: https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0 og:image: https://api.daily.dev/og/posts/tGg4nJNn0.png og:image:alt: Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary An Akira ransomware affiliate breached a network through an exposed SonicWall VPN device lacking MFA, then forced the compromised host into Windows Safe Mode with Networking via AnyDesk to disable the Huntress EDR agent and Microsoft Defender's real-time protection for about 10 minutes. The ransomware payload akira.exe failed to run in Safe Mode due to low virtual memory errors, so encryption never occurred, but the attacker still exfiltrated credentials and files using WinRAR and s5cmd within under five hours of initial access. Huntress notes this is the first Akira incident observed using this Safe Mode EDR-evasion technique, previously seen with Snatch and AvosLocker, and recommends VPN MFA, credential-spraying detection, and monitoring for Safe Mode boot changes. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the Akira ransomware group disable EDR protection during an attack? An Akira affiliate used AnyDesk remote access to force a compromised Windows host to reboot into Safe Mode with Networking, which disabled the Huntress EDR agent and Microsoft Defender's real-time protection for about 10 minutes. They also added AnyDesk to the Safe Mode registry so it would keep running after reboot, retaining remote access while security tools were blinded. _Security teams tracking EDR evasion tactics like Safe Mode abuse follow incident writeups like this on daily.dev._ ### Why did the Akira ransomware payload fail to encrypt files after disabling EDR? The akira.exe payload failed to execute when launched via AnyDesk while the system was in Safe Mode, generating out-of-memory and PowerShell errors because Windows reported low virtual memory in that limited startup state. A scheduled Microsoft Defender scan later detected the file but could not remove it until the machine was rebooted into normal mode, which restored real-time protection and let Defender quarantine it. _Teams evaluating ransomware resilience gaps can follow these detection-and-response details on daily.dev._ ### What initial access vector did the Akira ransomware affiliate use in this attack? The attacker gained initial access through an exposed SonicWall VPN device that lacked multi-factor authentication. About two hours after logging in via VPN, they connected to the domain controller over RDP, enumerated Active Directory, moved to an application server, and exfiltrated data using WinRAR and the s5cmd tool to an attacker-controlled S3 bucket, all within under five hours. _Admins hardening VPN access against credential-based attacks track incidents like this on daily.dev._ ## Similar posts on daily.dev - [Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack](https://daily.dev/posts/up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack-bhmp0lmjy) · Huntress Blog · 0 upvotes · 0 comments - [Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise](https://daily.dev/posts/anatomy-of-an-akira-ransomware-attack-when-a-fake-captcha-led-to-42-days-of-compromise-m938g6bre) · Unit 42 · 1 upvotes · 0 comments - [Akira, LimeWire, and the Sour Taste of Data Exfiltration](https://daily.dev/posts/akira-limewire-and-the-sour-taste-of-data-exfiltration-zpopdyjtp) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#windows](https://daily.dev/tags/windows), [#ransomware](https://daily.dev/tags/ransomware) [View this post on daily.dev](https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt","url":"https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0"},"datePublished":"2026-08-13T20:49:04.560Z","dateModified":"2026-08-18T16:28:29.238Z","description":"An Akira ransomware affiliate breached a network through an exposed SonicWall VPN device lacking MFA, then forced the compromised host into Windows Safe Mode...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebb98871aab42da052f0cf5d06c3bdc7?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/ebb98871aab42da052f0cf5d06c3bdc7?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"windows,ransomware","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-tgg4njnn0#faq","mainEntity":[{"@type":"Question","name":"How did the Akira ransomware group disable EDR protection during an attack?","acceptedAnswer":{"@type":"Answer","text":"An Akira affiliate used AnyDesk remote access to force a compromised Windows host to reboot into Safe Mode with Networking, which disabled the Huntress EDR agent and Microsoft Defender's real-time protection for about 10 minutes. They also added AnyDesk to the Safe Mode registry so it would keep running after reboot, retaining remote access while security tools were blinded. Security teams tracking EDR evasion tactics like Safe Mode abuse follow incident writeups like this on daily.dev."}},{"@type":"Question","name":"Why did the Akira ransomware payload fail to encrypt files after disabling EDR?","acceptedAnswer":{"@type":"Answer","text":"The akira.exe payload failed to execute when launched via AnyDesk while the system was in Safe Mode, generating out-of-memory and PowerShell errors because Windows reported low virtual memory in that limited startup state. A scheduled Microsoft Defender scan later detected the file but could not remove it until the machine was rebooted into normal mode, which restored real-time protection and let Defender quarantine it. Teams evaluating ransomware resilience gaps can follow these detection-and-response details on daily.dev."}},{"@type":"Question","name":"What initial access vector did the Akira ransomware affiliate use in this attack?","acceptedAnswer":{"@type":"Answer","text":"The attacker gained initial access through an exposed SonicWall VPN device that lacked multi-factor authentication. About two hours after logging in via VPN, they connected to the domain controller over RDP, enumerated Active Directory, moved to an application server, and exfiltrated data using WinRAR and the s5cmd tool to an attacker-controlled S3 bucket, all within under five hours. Admins hardening VPN access against credential-based attacks track incidents like this on daily.dev."}}]} ```