Akira ransomware crew broke its own encryptor hiding in Windows Safe Mode

An Akira ransomware affiliate broke into a target's network through a SonicWall SSL VPN account that had no multi-factor authentication, then crashed its own encryption tool trying to cover its tracks, according to a Huntress security analysis published this week.

The attacker got in on August 4 after a credential-spray burst against the VPN, succeeding with a valid but unprotected account minutes after the failed attempts stopped. From there it moved to the domain controller over RDP, pulled a full Active Directory dump of every user and computer on the network, then spent roughly three hours staging data: archiving mapped file shares with WinRAR, moving the archives out through the s5cmd command-line tool, and installing AnyDesk configured to launch at startup as a backup access point.

To clear the way for encryption, the attacker forced a reboot into Windows Safe Mode with Networking, a known technique for disabling endpoint agents and Microsoft Defender's real-time protection before running ransomware. It worked. But Safe Mode also runs with sharply limited virtual memory, and the akira.exe payload couldn't cope: within 13 seconds of launch it started throwing memory errors, and the encryption run collapsed.

Huntress's recommended defenses map directly onto what failed here: MFA on every VPN account, alerts on credential-spray bursts against multiple usernames from one source, and monitoring for the specific signals a Safe Mode ransomware attempt leaves behind, boot-configuration changes, the Windows event IDs for SAFEBOOT and security-service stops, and new entries in the Safe Mode minimal-services registry key. None of that requires a dedicated security team to set up, just a VPN config change and a few alert rules.