Akira Disables EDR and Antivirus in Safe Mode but Fails to Encrypt Files

Initial Access Begins with a VPN Without MFA

An affiliate of the Akira ransomware group compromised a corporate network after gaining access to an Internet-exposed SonicWall VPN device that lacked multifactor authentication.

The incident occurred on August 4, 2026. The investigation published on August 13, 2026 revealed an attack chain completed in less than five hours, although the file-encryption stage was unsuccessful.

The lack of MFA allowed the attacker to bypass the initial control using valid credentials. How those credentials were obtained remains unknown, but the operation included activity consistent with reconnaissance and possible abuse of corporate accounts.

Approximately two hours after logging in to the VPN, the intruder reached the domain controller using RDP. From there, they enumerated users and computers in Active Directory, gathering information to support lateral movement to an application server.

Active Directory, RDP, and Legitimate Tools Used to Prepare the Attack

The activity went beyond initial access. The attacker used information gathered from Active Directory to move through the network and identify systems and shares of interest.

On a compromised system, the attacker installed AnyDesk, using it both for remote access and to establish a form of persistence. The software, normally used for remote support, was added to the Windows Safe Mode startup configuration.

To collect data, the affiliate used WinRAR to archive mapped network shares. The archives were then transferred with s5cmd, a client for managing Amazon S3-compatible storage, to an attacker-controlled bucket.

The sequence therefore combined administrative tools and legitimate applications: RDP for remote control, Active Directory tools for reconnaissance, WinRAR for collection, and s5cmd for exfiltration. This reduces reliance on custom malware and can make detection based solely on signatures more difficult.

Rebooting into Safe Mode Suspends Huntress and Defender

The most significant aspect of the attack involved using Safe Mode with Networking to temporarily disable endpoint defenses.

Through AnyDesk, the attackers rebooted the system into Safe Mode and modified the registry entries associated with Safe Mode services. This caused AnyDesk to start automatically after the reboot, restoring the attacker’s remote access.

The following protections were disabled:

• the Huntress MDR/EDR agent;
• Microsoft Defender real-time protection.

The computer remained for approximately 10 minutes without an operational EDR agent or real-time antivirus protection. Safe Mode loads fewer services and drivers, creating conditions that can prevent normally active security controls from starting.

However, the protections were not disabled permanently. A scheduled Defender scan detected the akira.exe file but could not remove it while the system was still in Safe Mode.

After the system returned to normal mode, Defender restored real-time protection and quarantined the payload.

The Ransomware Fails to Encrypt Files, but the Theft Is Still Enough to Extort the Victim

The Akira payload was launched through AnyDesk while the system was in Safe Mode. Execution failed because of virtual memory issues, out-of-memory errors, and PowerShell-related errors.

The failed launch prevented file encryption, but it did not eliminate the impact of the intrusion.

Before attempting encryption, the attacker had already compromised credentials, explored Active Directory, reached additional systems, and transferred data to an S3 infrastructure under their control. The stolen material could therefore be used to threaten publication or pursue other forms of extortion, even without a successful file-encryption operation.

The incident reflects a now-common ransomware model: encryption is only one available pressure tactic. Data theft, persistent access, and account compromise can have significant consequences even when the ransomware fails to complete its primary objective.

According to promotional data from the Blue Report 2026, defenses reportedly blocked 37% of actions when attackers used valid credentials. The percentage was derived from 338 million simulations conducted in customers’ production environments. The figure does not necessarily describe this specific incident, but it helps illustrate the advantage gained by the attacker during the initial phase.

The Technique Is New to Akira, Not to Ransomware

Huntress described this incident as the first observed use of Safe Mode-based defense evasion in an attack attributed to Akira.

The method is not new to the wider ransomware ecosystem. Ransomware families such as Snatch and AvosLocker have reportedly used it for years to prevent EDR agents and antimalware protections from loading during system startup.

For Akira, the technique adds another evasion method to an attack chain already involving VPN access, credential use, RDP, lateral movement, and exfiltration. The payload’s technical failure limited the operational damage but did not prevent data theft.

The exact versions of the products involved have not been disclosed.

Controls to Implement and Indicators to Monitor

The top priority is enabling MFA on all VPN accounts, without exceptions for users considered internal or privileged. Organizations should also implement detections for credential spraying, particularly against exposed services and remote-access portals.

Security teams should monitor for:

• unusual reboots into Safe Mode with Networking;
• registry modifications affecting services loaded in Safe Mode;
• the addition or launch of AnyDesk in that configuration;
• disabling of the Huntress agent or Defender real-time protection;
• RDP connections to domain controllers;
• anomalous enumeration of users and computers in Active Directory;
• use of WinRAR to create large archives;
• execution of s5cmd;
• transfers to unauthorized Amazon S3 buckets;
• the presence or execution of akira.exe.

Correlating these events is more valuable than treating any single alert in isolation. A Safe Mode reboot may have a legitimate explanation; the same event combined with AnyDesk installation, an RDP session to the domain controller, and S3 transfers is a high-priority compromise signal.