Akira Affiliate Rebooted a Compromised Host into Safe Mode to Disable EDR
Summary
Huntress analyzed an Akira intrusion that used an MFA-less SonicWall VPN and Safe Mode to disable EDR. The ransomware failed to encrypt files, but attackers had already exfiltrated credentials and file shares.
Key points
- A credential spray preceded a successful login to a SonicWall SSL VPN account without MFA.
- The attacker accessed a domain controller, enumerated Active Directory, archived file shares with WinRAR, and uploaded data using s5cmd.
- The attacker rebooted the host into Safe Mode with Networking, disabling the Huntress agent and Microsoft Defender real-time protection.
- Huntress reported this as the first Akira Safe Mode attempt observed in its telemetry.
- The Akira process encountered out-of-virtual-memory errors and did not encrypt files; Defender quarantined the binary after the host returned to normal mode.
- Credentials and file shares had already been exfiltrated, leaving the victim exposed to extortion despite the failed encryption attempt.
- Huntress recommends MFA for VPN accounts, broad EDR and log coverage, and alerts for Safe Mode boots and boot-configuration changes.
Article Details
- Attack Vectors
- Credential spray against an SSL VPN without MFA, followed by a successful login using a valid VPN account.
- Remote Desktop Protocol access to a domain controller for hands-on activity and Active Directory enumeration.
- WinRAR was used to archive mapped file shares, and s5cmd was used to upload staged data to an attacker bucket.
- AnyDesk was installed as a service and used for remote control and payload delivery.
- The operator configured Safe Mode with Networking to disable endpoint security services before launching the ransomware.
- Defensive Notes
- Require MFA for every VPN account and alert on bursts of failed logins correlated with a successful login from the same source.
- Deploy EDR to every host and ingest VPN and Windows Event Logs into a SIEM.
- Alert on boot-configuration changes and Safe Mode boots, including SAFEBOOT load options, BootMode=2, and third-party security services stopping.
- Monitor changes to the Safe Mode minimal-service registry list.
- If compromise is suspected, rotate Active Directory and VPN credentials; treat data in the Get-ADUser dump as exposed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 72[.]23[.]77[.]35 | External source IP of the successful SSL VPN login used for initial access. |
| SHA256 | 414b9985f46714f44dd1bd63860d2a48dcfababcfe5c712a4b4f575378127a56 | Hash of akira.exe, identified as the Akira ransomware payload. |
| SHA256 | e2356c742c74cce5c6b6100162d0071a3f71e2fed2ed895c2011061a95b3299a | Hash of S5cmd.exe, identified as the S3 exfiltration tool. |
MITRE ATT&CK
T1018 · Remote System DiscoveryGet-ADComputer was used to enumerate domain computers and export their properties to AdComp.txt.T1087 · Account DiscoveryGet-ADUser was used to enumerate domain users and export their properties to AdUsers.txt.T1560.001 · Archive via UtilityWinRAR recursively archived mapped file shares before exfiltration.T1567.002 · Exfiltration to Cloud Storages5cmd uploaded staged files to an attacker-controlled S3 bucket.T1688 · Safe Mode BootThe operator configured a reboot into Safe Mode with Networking, disabling third-party security services and Defender real-time protection.
People
Threat Actors
Malware
Vendors
HuntressAs such, the reboot stopped the Huntress agent and disabled Microsoft Defender's real-time protection; Defender couldn't quarantine the file until the attacker rebooted back to normal mode.MicrosoftAs such, the reboot stopped the Huntress agent and disabled Microsoft Defender's real-time protection; Defender couldn't quarantine the file until the attacker rebooted back to normal mode.SonicWallAfter gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry.
Products
AnyDeskAnyDesk: The Delivery and C2 ChannelSonicWall SSL VPNwithin a few hours. Huntress has documented that playbook in depth: from the active exploitation of SonicWall SSL VPN appliances as an initial-access vector, to a recent case where an affiliate spun up a brand-newWindows Defenderare excluded from that minimal driver set by design, the reboot took both the Huntress agent and Windows Defender real-time protection offline in a single move, all while preserving the network access needed toWinRARSSL VPN entry, the same AdUsers.txt/AdComp.txt Active Directory dumps opened in Notepad, the same WinRAR-then-cloud-upload exfil, but with one twist we hadn't seen from Akira before. Instead of dodging EDR by