Akira ransomware attacker uses Safe Mode reboot to evade EDR

An attacker using Akira ransomware was observed rebooting a victim host in Safe Mode to avoid endpoint defenses, a first for Akira ransomware attacks, Huntress revealed in a report Wednesday.

The attack in early August began with initial access via an exposed SonicWall SSL VPN that was not protected with multi-factor authentication (MFA). Akira ransomware-as-a-service affiliates are known to target exposed VPNs, especially SonicWall VPNs, for initial access. After multiple failed login attempts, the attacker successfully logged in and accessed the domain controller via the Remote Desktop Protocol (RDP) about two hours later.

The Akira attack then continued with a familiar pattern of Active Directory enumeration and installation of WinRAR to archive files prior to exfiltration. The utility s5cmd was used to transfer the stolen files to the attacker’s S3 cloud bucket, setting the stage for a double extortion attack.

The AnyDesk remote desktop tool was subsequently installed to serve as a persistent command-and-control (C2) channel and delivery mechanism for the final Akira ransomware payload. The researchers noted clear hands-on-keyboard activity throughout the attack, with scripts being manually pasted through the AnyDesk clipboard channel. The ransomware payload, akira.exe, was transferred through the AnyDesk connection prior to the Safe Mode reboot.

The reboot was forced via msconfig.exe, booting Windows in Safe Mode with Networking. This mode allows for internet connection but causes most third-party services to not start upon boot, including endpoint detection and response (EDR) services. In this case, Huntress’ own EDR was blocked from starting, and Windows Defender real-time protection (RTP) was also made unavailable.

The use of Safe Mode for EDR evasion has not been previously documented in Akira ransomware attacks, although it has previously been seen in attacks by the Snatch, Embargo and AvosLocker ransomware operations.

Prior to rebooting, the attacker had created a registry entry ensuring the AnyDesk service would still launch in Safe Mode. After the reboot, they executed the ransomware payload, however, file encryption failed due to insufficient virtual memory to sustain the process.

While Windows Defender ultimately detected the Akira ransomware during a scheduled scan, without RTP active, the system was unable to automatically remediate the threat. It wasn’t until the attacker later rebooted normally, out of Safe Mode, that RTP kicked in and removed the malware.

The Huntress researchers noted that, although the ransomware in this case was unable to detonate and encrypt files while in Safe Mode, the attacker still gained access to steal files and may still use this evasion method in future attacks.

“That’s a lucky side effect of the attacker’s own mistake in these circumstances, not a defence you can plan around. Ultimately, this could be a case of winning the battle, but not the war,” Huntress Senior Security Operations Analyst James Northey wrote. “It’s possible that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to encrypt the endpoint in Safe Mode.”

Northey added that the ransomware itself could also be retooled to ensure reliable Safe Mode detonation.

The researchers recommended organizations secure their VPNs by requiring MFA on every account, alerting on bursts of failed logins and rotating VPN credentials after a compromise. An alert for failed logins could have helped prevent this attack, the researchers said, noting the two-hour gap between the successful VPN login and the first use of RDP by the attacker.

Huntress also recommended alerting on Safe Mode boots and boot configuration changes, including the unexpected addition of tools to the Safe Mode minimal service registry list. Events to alert on can include Kernel-Boot EID 27 with a SAFEBOOT load option, Kernel-General EID 12 with BootMode=2, System EID 7036 indicating the stopping of third-party security services, and any suspicious msconfig.exe or bcdedit activity.