AIBRIEF
The Akira extortion group forced a compromised host into Microsoft's built in Safe Mode, unloading Defender and the Huntress agent before encryption.
The Akira ransomware group forced a Windows host into Microsoft's built-in Safe Mode so it could encrypt files without antivirus interference, according to incident responders at Huntress.
The entry point was a SonicWall SSL VPN account without multi-factor authentication. On August 4, attackers sprayed stolen credentials at the exposed account; a successful login followed about seven minutes later. They then reached a domain controller, archived mapped file shares with WinRAR, and uploaded the archives to an attacker-controlled cloud bucket.
The Safe Mode pivot used the host's own configuration panel. The operators ran msconfig.exe, the Windows system-configuration tool, to set the next boot to Safe Mode with Networking, then forced a reboot. In that mode Windows loads only a minimal set of drivers and services, so products like Microsoft Defender's real-time protection and Huntress's endpoint agent do not start. Akira's encryptor then ran unimpeded until a normal reboot let Defender quarantine it at 08:12 UTC.
MITRE ATT&CK tracks the behavior as technique T1688, "Impair Defenses: Safe Mode Boot." Huntress analyst James Northey said the firm had not seen Akira use the approach before. Safe Mode evasion is not new: the Snatch and AvosLocker ransomware families used the same trick years earlier.
Defenders have a short checklist. Enforce multi-factor authentication on every VPN and remote-access account. Confirm endpoint security products stay active in Safe Mode with Networking. Alert on msconfig.exe changes that alter Safe Boot settings, and audit AnyDesk remote-access installs paired with bulk file archiving.