Akira Ransomware Adopts Safe Mode Tactics to Evade Detection

Affiliates of Akira ransomware have recently demonstrated an alarming technique aimed at bypassing endpoint detection and response (EDR) systems by rebooting compromised Windows machines into Safe Mode with Networking enabled. This maneuver has effectively neutralized both Huntress's real-time agent and Microsoft Defender’s protective measures, creating a critical window for unauthorized activities. This shift in tactics raises eyebrows about the evolution of ransomware strategies and the effectiveness of existing security frameworks.

Credential-Spraying Attack: A Vulnerability Exposed

The assault, which occurred on August 4, began with a credential-spraying attack targeting an exposed SonicWall SSL VPN. This method involves systematically trying a small number of commonly used passwords against many accounts, showing that attackers are increasingly capitalizing on poor access controls. It took only about seven minutes for the attacker to gain access through an account lacking multi-factor authentication (MFA), according to Huntress analyst James Northey. The speed at which they gained access underscores a common issue in cybersecurity: a significant number of organizations still lag in applying MFA as a baseline security measure, leaving them vulnerable to such attacks.

Once the malicious actor obtained credentials, they rapidly accessed the domain controller via RDP, a tool usually employed for legitimate administrative purposes. Their actions included extensive enumeration of Active Directory, a crucial step that allowed them to identify potential targets for data exfiltration. Transitioning to an application server, the adversary used WinRAR to aggregate data from mapped file shares, culminating in storage within an attacker-controlled S3 bucket, marking the implementation of a double-extortion strategy. This tactic not only threatens to encrypt data but also involves the risk of public release if demands aren’t met. 

The Transition to Safe Mode: Bypassing EDR Protections

Following these steps, AnyDesk was installed on the infected machine, granting persistent remote access to deploy the Akira ransomware payload. In a clever twist, the attacker used “msconfig.exe” to reboot the machine into Safe Mode with Networking, sidestepping EDR protections instead of disabling them directly. This tactic highlights a strategic pivot from typical ransomware deployment methods, focusing on exploiting Windows’ inherent functionalities rather than purely relying on malware sophistication.

Safe Mode Gaining Traction Among Ransomware Operators

Safe Mode typically serves as a diagnostic environment in Windows, loading only core drivers and services. This restriction inadvertently leaves many third-party security solutions inactive, making it an appealing choice for malicious actors. Akira's attackers anticipated that AnyDesk could be down too, so they modified the Safe Boot registry configuration to ensure continued operation of the remote-access service. Many security professionals might underestimate this clever alteration in registry settings, failing to consider the nuanced tactics cybercriminals deploy.

This methodology isn't entirely novel; Huntress noted similar tactics used by ransomware variants like Snatch and AvosLocker, which have leveraged Safe Mode for years. The behavior is documented in MITRE ATT&CK as T1688, designed to "impair defenses" through Safe Mode. This is significant because it reveals a shared tactic among advanced threat actors, indicating a potential shift in how ransomware operates.

Unexpected Ransomware Challenges Post-Safe Mode

However, this technique did not yield the anticipated results for the attacker. Once “akira.exe” initiated in Safe Mode, the system began to report critical memory issues, including notifications like “Virtual Memory Minimum Too Low” and “Out of Virtual Memory.” Such constraints appeared to inhibit the ransomware’s functionality. In a field often characterized by obstacles and workarounds, this situation serves as a reminder that even sophisticated plans can run into execution barriers.

Ultimately, Microsoft Defender detected the Akira binary but could not neutralize it while real-time protection was down. The malicious file was only quarantined after a subsequent reboot brought the system back into standard operational mode, enabling Defender's protection mechanism. This sequence of events unpacks a tangled web of security dynamics: attackers are evolving while defenders must scramble to keep pace. While this may seem like a victory for Defender, Huntress warned it was likely a temporary glitch linked to Akira’s resource demands rather than a reliable safeguard against future attacks.

Organizations are advised to prioritize detection proactively, ensuring that all VPN accounts enforce MFA and correlating instances of multiple failed logins with successful authentications. Furthermore, deploying EDR across all machines and scrutinizing SIEM feeds for any suspicious activities related to “msconfig.exe” or “bccedit” will fortify defenses against such approaches. That said, implementing these measures is easier said than done, as many organizations grapple with limited resources and awareness of threat landscapes.

Future Outlook and Implications

If you’re working in this space, consider the implications of these evolving tactics. Ransomware isn't showing signs of retreat; rather, it’s adapting. The strategies employed by Akira affiliates may soon inspire other cybercriminals, leading to a surge in similar attacks leveraging Safe Mode and modified Windows functionalities. This adaptation makes it imperative for companies to rethink their security protocols, as old measures simply won't cut it anymore.

As the technology behind ransomware continues to shift, organizations must ensure employees are equipped with the knowledge to recognize these threats. Strengthening internal training programs and fostering a culture of cybersecurity awareness may prove vital in mitigating risks associated with increasingly sophisticated attacks. Remember: while the current situation shows some weaknesses in Akira's approach, tomorrow's ransomware may learn from these missteps—and evolve accordingly.