Ransomware operators keep finding ways to knock out the tooling that is supposed to catch them. The latest Akira campaign shows one of the more awkward versions of this idea: reboot the Windows machine into Safe Mode with Networking, where most EDR agents do not load, then do the damage from a temporary blind spot.
Security vendor Huntress detailed the case after an Akira affiliate ran the playbook against a compromised network. The response is the interesting part. They disabled the endpoint protection, exfiltrated data, and then failed to encrypt anything because the Safe Mode environment itself ran out of memory on the encryptor. A textbook example of defense evasion working, and the payload still tripping over its own feet.
How the Safe Mode trick works
Windows Safe Mode boots the operating system in a minimal state, loading only essential drivers and services. EDR agents are almost always excluded from that set, so when the machine comes back up in Safe Mode, the antivirus and endpoint detection stack is not running. The endpoint is online, reachable, and defenseless at precisely the moment the attacker needs it to be.
The Akira affiliate triggered this with msconfig.exe, the System Configuration utility, to schedule the Safe Mode boot. They then edited the Safe Boot registry configuration so that AnyDesk, the remote access tool they relied on, would keep running after the reboot. That tiny detail is worth sitting on: it means the attacker walked back into the box the moment it came up, before any legitimate admin had a chance to intervene.
On Windows the technique is cataloged in the MITRE ATT&CK framework as T1688, Impair Defenses through a Safe Mode Boot.
The path in
The initial compromise did not start with some novel zero-day. The attackers made it through an exposed SonicWall VPN that had no multi-factor authentication and then moved laterally across the network, reaching domain controllers and application servers. From there the expected reconnaissance, credential harvesting, and staging happened before they pulled the trigger on the reboot.
For most defenders this part is the frustration. The heavy artillery that eventually lands is interesting, but the open front door is what should have stopped it weeks earlier. A VPN endpoint facing the internet with MFA disabled is the kind of exposure that shows up in inventory scans and still takes months to fix.
What happened after the reboot
With the EDR gone, the affiliate unpacked data using WinRAR and pushed it to an attacker-controlled S3 bucket through s5cmd, a fast S3 client, moving the stolen data off the network. That part worked.
Then the encryption phase failed. Inside the constrained Safe Mode environment, the encryptor hit “out of virtual memory” errors because not enough memory was allocated to the process. In effect, the minimalist boot environment the attacker chose to hide from the EDR also starved the ransomware of the resources it needed to finish the job.
What defenders should take from this
MFA on remote access is the single highest-leverage change. This whole incident starts with a VPN that had none. Enforce multi factor authentication on every VPN account, and treat the absence of it on an internet-facing remote access point as a critical finding, because it is what opened the door here.
Second, monitor for the boot toys. msconfig, bcdedit, and the tooling that changes the shutdown configuration and then restarts the machine are the telltale signs of this attack. A legitimate admin restarting into Safe Mode for maintenance is rare enough that it deserves attention, and the combination of a configuration change plus a reboot plus remote access staying alive is basically the whole story.
Third, watch the Safe Boot registry. If a machine comes back in Safe Mode and a remote access tool like AnyDesk is still present and connected, that is not an accident. Huntress said the affiliate specifically preserved that access path.
The limitation at the end of the pivot
It is also a reminder about resource limits. Ransomware tooling is not magic. Safe Mode constrains the environment so tightly that the same minimal boot that disables the endpoint protection can also break the encryption operation, which is what saved the target’s files even after their data was stolen. The affiliates are learning to size their own payloads against a rebooted minimal kernel, and defenders should not count on that failure repeating.
The bottom line
The Akira Safe Mode campaign is a good illustration of how far an affiliate will go to get a clean window for data theft, and how the tactic has a real ceiling. The open VPN without MFA is the avoidable primary cause. The msconfig and Safe Boot registry checks, plus ongoing EDR coverage and immediate scrutiny of any reboot into Safe Mode, give you your best chance of catching it before the exfil closure finishes.