Akira Ransomware Attack Backfires as Encryptor Crashes in Safe Mode

According to a report by security researchers Huntress, Akira is one of the most active cybercriminal organizations on the internet. Its typical method involves finding an exposed VPN instance with a weak or default password, gaining access to the domain controller, enumerating Active Directory, stealing sensitive data, and then deploying an encryptor that leaves a ransom note.

In this particular incident, after establishing persistence on a device, Akira rebooted it into Safe Mode with Networking. This Windows startup mode loads only essential drivers and services, excluding antivirus and endpoint detection and response (EDR) agents, while still providing internet access. "This means Defender real-time protection was down too," Huntress explained. "For the entire Safe Mode window, the host had no working EDR, and AV was blinded." The report notes this is MITRE ATT&CK T1688, a technique used by ransomware families like Snatch and AvosLocker for years, but observed in Akira for the first time.

However, Akira did not anticipate that Safe Mode with Networking would also prevent its encryptor from running. Safe Mode boots with a stripped-down environment and constrained virtual memory, and the Akira process tree appears to have starved it, triggering an "Out of Virtual Memory" pop-up and a cascade of PowerShell hard errors precisely when the payload tried to execute. The operators had no choice but to boot the device back up normally, at which point a scheduled Defender scan detected the encryptor, flagged it, and quarantined it.

Huntress warned that the takeaway is uncomfortable. "While Safe Mode blinded our controls, it may also have prevented the encryption it was meant to enable. That's a lucky side effect of the attacker's own mistake in these circumstances, not a defense you can plan around." The researchers stressed that not every victim might get such a lucky break, and a host with more physical memory or a larger page file could give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode. "Akira's developers or affiliates could retool the encryptor to reduce its memory demands or make its Safe Mode launch sequence more reliable, meaning that the same failure may not occur in a future intrusion."

To defend against Akira, Huntress recommends setting up alerts on bursts of failed VPN logins against multiple usernames from one source, since Akira typically starts with a brute-force attack on the VPN. Organizations should correlate those failures with a successful login from the same IP or ASN within a short window. Enabling multi-factor authentication on every VPN account is also advised, as is disabling or IP-allowlisting the SSL VPN during active attacks and rotating all Active Directory and VPN credentials if compromised, treating every account in the Get-ADUser dump as exposed.

Additionally, EDR should be deployed on every host, along with a SIEM that ingests VPN and Windows Event Logs. "The first VPN logons were visible hours before any detonation—this time advantage is only possible if the logs are on SIEM." Finally, organizations should set up alerts on boot-configuration changes and Safe Mode boots to catch Akira in the act.