Akira Ransomware Uses Safe Mode to Blind EDR: Lessons for Defenders

Akira ransomware operators have demonstrated how abusing Windows Safe Mode can effectively disable or bypass endpoint detection and response (EDR) tools, underscoring the need for defenders to harden recovery environments, monitor Safe Mode activity, and implement layered detection controls that remain effective even during system startup changes.

Transcript

Copy

SPEAKER_00 0:02

Good morning, good afternoon, or good evening, whenever you may be, and welcome to another episode of the SOC Brief. This is your go-to podcast for staying ahead of the ever-evolving world of cybersecurity threats. I'm your host Andrew, and today we're going to discuss a recent and very practical ransomware tactic that security researchers observed last week. An Akira ransomware affiliate forced a compromised Windows system into safe mode with networking in order to disable endpoint detection and response tools before attempting to encrypt the machine. We'll discuss how the attack unfolded, why this technique is effective, and the concrete steps your SOC can take to detect and disrupt it. So Akira remains one of the more active ransomware as a service operations. In this particular incident, the attackers gained initial access through an MFA-less SonicWall VPN, and we tend to see that a lot. Once inside, they quickly connected to a domain controller via RDP, did active directory enumeration, and then did data collection with WinRAR. They then exfiltrated to an attacker-controlled S3 bucket using the S5 CMD tool, and they also installed any desk for persistence. And what made this case stand out is what came next. The threat actors used MSconfig to force the system to reboot into safe mode with networking. For those unfamiliar, safe mode loads only a minimal set of drivers and services, which means most third-party EDR agents and even Microsoft Defender's real-time protection do not start. For roughly 10 minutes, the host was effectively blind from a security monitoring perspective. The attackers even registered any desk under the SafeMode Registry keys, so their remote access survived the reboot. Ironically, the same constrained environment that blinded the defenses also caused the Akira encryptor to fail. The payload ran into an out-of-virtual memory error and never completed encryption. A scheduled defender scan later detected the ransomware binary, and once the system returned to normal mode, the file was quarantined. But data had already been stolen, and so the extortion risk remained. And this all matters because safe mode boot is a known defense evasion technique, and other ransomware families have used it for years. But this one appears to be the first time security researchers observed Akira employing it. When attackers can temporarily disable your primary endpoint protections, the window for detection and response shrinks dramatically. Even when encryption fails, the data exfiltration stage of modern double extortion tactics is often complete before the reboot. For SOCS, detecting this attack is going to start with monitoring for execution of msconfig.exe or the bcd edit.exe, especially when followed by a reboot. You can look for kernel boot event ID 27 that includes a safe boot load option, kernel general event ID 12 showing boot mode 2, and system event ID 7036 indicating third-party security services stopping. Also watch for new entries being added under the Safe Boot Registry keys, as those are all signals or signs to give you a chance to get alerted on that activity before or during the blind window. On the prevention side, make sure you're enforcing MFA on all remote access tools, especially VPN appliances, and treat internet facing management interfaces as high value targets. And we always recommend disabling those completely if able. Ensure your EDR agents are deployed and healthy across the environment, and consider additional controls that can still provide some visibility or alerting even when real-time protection is offline. Make sure you're restricting who can modify boot configuration and safe mode settings on endpoints. For threat hunting, search recent logs for safe mode boots, anydesk, or other remote access tools registered under Safe Boot Keys, and any unusual use of tools like S5 CMD or WinRAR against file shares. You can also integrate the latest Acura and related IOCs into your detection rules so you can catch the early stages of the attack chain. And the bottom line here is that this Acura safe mode case shows that ransomware operators continue to look for ways to bypass endpoint protections. Socks that monitor boot configuration changes and treat unexpected safe mode activity as a high priority signal have a much better chance of interrupting these attacks before encryption happens, or at least before the full impact is realized. So here's some closing thoughts and a call to action. Akira's use of safe mode to blind EDR is a reminder that even well-known techniques can still catch organizations off guard when applied by active ransomware groups. SOCs need to watch for the behavioral precursors like boot configuration changes, unexpected reboots into safe mode, and registry modifications to help shrink the attacker's window of opportunity. This week I challenge everyone to review your detection coverage for safe mode and boot related events, and verify that MFA is being enforced on all VPN and remote access solutions. Run one quick hunt for a recent MS config or BCD edit activity, and anything that seems out of place, share that with your team. That's a wrap for this episode of the SOC Brief. If you have questions or own ransomware evasion stories, hit us up on social media or via our website. Keep your eyes open, keep sharpening those skills, and we'll talk soon. And as always, stay secure out there. Bye.