Huntress: Akira Affiliate Disabled EDR in Safe Mode but Failed to Encrypt Files
Summary
Huntress reports an Akira affiliate accessed a network through a SonicWall VPN without MFA, disabled defenses in Safe Mode, and stole credentials and files. The ransomware payload failed to run, but the data was used for extortion.
Key points
- Huntress says the attacker gained access through an exposed SonicWall VPN without MFA.
- The attacker used RDP to reach a domain controller, enumerated Active Directory, and moved to an application server.
- WinRAR and s5cmd were used to archive files and upload stolen data to an attacker-controlled S3 bucket.
- AnyDesk was used to boot the host into Safe Mode with Networking, disabling the Huntress agent and Microsoft Defender real-time protection.
- The Akira payload failed to execute in Safe Mode after low-virtual-memory and other errors.
- A scheduled Defender scan detected the payload; Defender quarantined it after the attacker rebooted into normal mode.
- Huntress recommends MFA for VPN accounts and monitoring for Safe Mode configuration changes and remote-access tools added to its service registry.
Article Details
- Attack Vectors
- Initial access through an exposed SonicWall VPN device without multi-factor authentication.
- Lateral movement to a domain controller over RDP, followed by Active Directory user and computer enumeration.
- Data theft: WinRAR was used to archive mapped file shares, and s5cmd uploaded the archives to an attacker-controlled S3 bucket.
- AnyDesk was installed for remote access and used to reboot the compromised host into Safe Mode with Networking, where the attacker disabled the Huntress agent and Microsoft Defender real-time protection.
- The attacker added AnyDesk to the Windows Safe Mode registry so it would start after reboot and preserve remote access.
- The Akira ransomware payload was launched in Safe Mode but failed to execute; the affiliate still stole credentials and files for extortion.
- Defensive Notes
- Enable multi-factor authentication for all VPN accounts.
- Deploy detection for credential spraying.
- Monitor for Safe Mode boot-configuration changes and remote-access tools being added to the Safe Mode service registry.
MITRE ATT&CK
T1018 · Remote System DiscoveryThe attacker enumerated computers in the Active Directory environment.T1021.001 · Remote Desktop ProtocolThe attacker connected to the domain controller via RDP.T1087.002 · Domain AccountAfter reaching the domain controller, the attacker enumerated Active Directory users.T1112 · Modify RegistryThe attacker modified the Windows Safe Mode registry so AnyDesk would start after reboot.T1133 · External Remote ServicesThe affiliate gained initial access through an exposed SonicWall VPN device.T1219 · Remote Access ToolsAnyDesk was installed and used to maintain remote access to the compromised host.T1486 · Data Encrypted for ImpactThe attacker attempted to launch the Akira ransomware payload to encrypt files, but it failed to execute.T1560.001 · Archive via UtilityWinRAR was used to archive mapped file shares before they were uploaded.T1562.001 · Disable or Modify ToolsIn Safe Mode, the attacker disabled the Huntress agent and Microsoft Defender real-time protection.T1567.002 · Exfiltration to Cloud StorageThe attacker used s5cmd to upload stolen data to an attacker-controlled S3 bucket.
Threat Actors
Malware
AkiraAn Akira ransomware affiliate breached a network through an exposed SonicWall VPN without MFA, then moved laterally, stole data, and used AnyDesk plus Safe Mode with Networking to disable defenses.AvosLockerHuntress notes that other ransomware families, such as Snatch and AvosLocker, have used this tactic for years, but this incident marks the first time the company observed it in an Akira attack.SnatchHuntress notes that other ransomware families, such as Snatch and AvosLocker, have used this tactic for years, but this incident marks the first time the company observed it in an Akira attack.
Vendors
Huntress#AkiraMicrosoftAnyDesk was installed and used to boot the host into Safe Mode with Networking and disable EDR and Microsoft Defender.SonicWallAn Akira ransomware affiliate breached a network through an exposed SonicWall VPN without MFA, then moved laterally, stole data, and used AnyDesk plus Safe Mode with Networking to disable defenses.
Products
AnyDeskAn Akira ransomware affiliate breached a network through an exposed SonicWall VPN without MFA, then moved laterally, stole data, and used AnyDesk plus Safe Mode with Networking to disable defenses.Microsoft Defender Antimalware PlatformAnyDesk was installed and used to boot the host into Safe Mode with Networking and disable EDR and Microsoft Defender.Microsoft WindowsSafe Mode is a Windows startup state designed for troubleshooting and diagnostic operations.WinRARWinRAR and s5cmd were used to archive and upload stolen data to an attacker-controlled S3 bucket.