--- title: Akira Ransomware Affiliate Rebooted Into Safe Mode to... description: An Akira ransomware affiliate broke into a network via a SonicWall VPN account lacking MFA, moved laterally to the domain controller, exfiltrated Active... canonical: https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack | daily.dev og:description: An Akira ransomware affiliate broke into a network via a SonicWall VPN account lacking MFA, moved laterally to the domain controller, exfiltrated Active... og:url: https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07 og:image: https://api.daily.dev/og/posts/1ea8RiD07.png og:image:alt: Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack **[IT Security Guru](https://daily.dev/sources/itsecurityguru)** · 5 min read · 0 upvotes · 0 comments ## Summary An Akira ransomware affiliate broke into a network via a SonicWall VPN account lacking MFA, moved laterally to the domain controller, exfiltrated Active Directory and file share data, then rebooted the compromised host into Windows Safe Mode with Networking to disable both an EDR agent and Microsoft Defender before launching the encryptor. The attacker had pre-configured AnyDesk to survive the reboot, but Safe Mode's constrained memory environment caused the akira.exe payload to crash with out-of-memory errors before encryption began. Defender later flagged the payload but couldn't quarantine it until the host was rebooted back to normal mode. Despite the failed encryption, exfiltrated data still left the victim exposed to extortion. Huntress, which disclosed the incident, warned the technique could become reliable on systems with more memory and recommended monitoring for Safe Mode reboots, msconfig/bcdedit activity, and enforcing MFA on VPN accounts. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Can rebooting a compromised Windows server into Safe Mode disable EDR and Microsoft Defender? Yes, Safe Mode loads only core Windows drivers and disables most third-party software by design, which takes third-party EDR agents offline and prevents Microsoft Defender's real-time protection from starting. An Akira ransomware affiliate used this via msconfig.exe with Safe Mode with Networking during an intrusion, though the technique also crashed their own ransomware payload due to memory constraints. _Security teams tracking novel EDR evasion techniques like this follow incident writeups on daily.dev._ ### Why did the Akira ransomware payload fail to encrypt files after disabling EDR via Safe Mode? The akira.exe payload crashed minutes after launch, throwing out of virtual memory errors, because Safe Mode's constrained memory environment could not support the ransomware's resource demands. Huntress noted a host with more memory or a larger page file might let the encryptor succeed, so the failure was incidental rather than a reliable defense. _Incident responders weighing which mitigations actually hold up can track cases like this on daily.dev._ ### How did the Akira ransomware affiliate initially gain access to the victim network? The attacker used a credential-spraying attack against a SonicWall SSL VPN, succeeding roughly seven minutes after the failed login burst began by finding a valid account with no multi-factor authentication enabled. From there they logged into the domain controller over RDP within two hours and ran PowerShell commands to enumerate Active Directory. _Teams hardening VPN and MFA policies against credential spraying can follow related security incidents on daily.dev._ ## Similar posts on daily.dev - [Up a Creek Without a Command Line: Mapping an Akira Ransomware Attack](https://daily.dev/posts/up-a-creek-without-a-command-line-mapping-an-akira-ransomware-attack-bhmp0lmjy) · Huntress Blog · 0 upvotes · 0 comments - [From Bing Search to Ransomware: Bumblebee and AdaptixC2 Deliver Akira](https://daily.dev/posts/from-bing-search-to-ransomware-bumblebee-and-adaptixc2-deliver-akira-zxztijvul) · The DFIR Report · 0 upvotes · 0 comments - [Anatomy of an Akira Ransomware Attack: When a Fake CAPTCHA Led to 42 Days of Compromise](https://daily.dev/posts/anatomy-of-an-akira-ransomware-attack-when-a-fake-captcha-led-to-42-days-of-compromise-m938g6bre) · Unit 42 · 1 upvotes · 0 comments - [Akira, LimeWire, and the Sour Taste of Data Exfiltration](https://daily.dev/posts/akira-limewire-and-the-sour-taste-of-data-exfiltration-zpopdyjtp) · Huntress Blog · 0 upvotes · 0 comments --- Tags: [#ransomware](https://daily.dev/tags/ransomware), [#vpn](https://daily.dev/tags/vpn), [#active-directory](https://daily.dev/tags/active-directory) [View this post on daily.dev](https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack","url":"https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07"},"datePublished":"2026-08-13T14:24:27.198Z","dateModified":"2026-08-18T16:28:29.238Z","description":"An Akira ransomware affiliate broke into a network via a SonicWall VPN account lacking MFA, moved laterally to the domain controller, exfiltrated Active...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfc8f95087cb30245ae48a1ed8937144?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/cfc8f95087cb30245ae48a1ed8937144?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"IT Security Guru","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"IT Security Guru","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/ae9fe7d07c814192b35f86ad698fb374","url":"https://daily.dev/sources/itsecurityguru"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ransomware,vpn,active-directory","timeRequired":"PT5M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"IT Security Guru","item":"https://daily.dev/sources/itsecurityguru"},{"@type":"ListItem","position":3,"name":"Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/akira-ransomware-affiliate-rebooted-into-safe-mode-to-dodge-edr-and-broke-its-own-attack-1ea8rid07#faq","mainEntity":[{"@type":"Question","name":"Can rebooting a compromised Windows server into Safe Mode disable EDR and Microsoft Defender?","acceptedAnswer":{"@type":"Answer","text":"Yes, Safe Mode loads only core Windows drivers and disables most third-party software by design, which takes third-party EDR agents offline and prevents Microsoft Defender's real-time protection from starting. An Akira ransomware affiliate used this via msconfig.exe with Safe Mode with Networking during an intrusion, though the technique also crashed their own ransomware payload due to memory constraints. Security teams tracking novel EDR evasion techniques like this follow incident writeups on daily.dev."}},{"@type":"Question","name":"Why did the Akira ransomware payload fail to encrypt files after disabling EDR via Safe Mode?","acceptedAnswer":{"@type":"Answer","text":"The akira.exe payload crashed minutes after launch, throwing out of virtual memory errors, because Safe Mode's constrained memory environment could not support the ransomware's resource demands. Huntress noted a host with more memory or a larger page file might let the encryptor succeed, so the failure was incidental rather than a reliable defense. Incident responders weighing which mitigations actually hold up can track cases like this on daily.dev."}},{"@type":"Question","name":"How did the Akira ransomware affiliate initially gain access to the victim network?","acceptedAnswer":{"@type":"Answer","text":"The attacker used a credential-spraying attack against a SonicWall SSL VPN, succeeding roughly seven minutes after the failed login burst began by finding a valid account with no multi-factor authentication enabled. From there they logged into the domain controller over RDP within two hours and ran PowerShell commands to enumerate Active Directory. Teams hardening VPN and MFA policies against credential spraying can follow related security incidents on daily.dev."}}]} ```