Akira Ransomware Uses Safe Mode to Evade EDR Detection

• •Akira ransomware affiliates exploited an exposed SonicWall SSL VPN for initial access.
• •The use of Safe Mode allowed the attacker to disable EDR tools, but also led to ransomware failure.
• •This incident underscores the evolving tactics of ransomware groups to evade detection.

In early August 2026, an Akira ransomware affiliate executed an attack leveraging Safe Mode to evade endpoint detection and response (EDR) tools. The attack began with credential spraying against an exposed SonicWall SSL VPN lacking multi-factor authentication (MFA), leading to unauthorized access to the domain controller via Remote Desktop Protocol (RDP). The attacker performed Active Directory enumeration and collected sensitive files, transferring them to cloud storage using s5cmd. Uniquely, the attacker rebooted the compromised system into Safe Mode with Networking to disable security tools, including Huntress and Windows Defender. However, this tactic backfired, as it caused the ransomware payload to fail due to insufficient virtual memory. Although the attack did not result in file encryption, it highlighted a significant tactic used by ransomware groups to bypass security measures. Future attacks may not be as fortunate if the attackers adjust their methods to ensure successful encryption in Safe Mode.