Akira in Safe Mode: Blind EDR and the Ransomware That Collapsed From Memory Starvation

On August 4, 2026, an Akira ransomware affiliate shut down every security sensor on a corporate endpoint with a known but effective move: a forced reboot into Safe Mode with Networking via msconfig.exe. The Huntress agent and Microsoft Defender real-time protection never started. Encryption never happened: the akira.exe process threw "Out of Virtual Memory" errors and a cascade of PowerShell hard errors the moment it tried to activate. The entire attack, from initial access to payload crash, lasted less than five hours. The data had already been exfiltrated.

How the Attacker Built the Compromise

The attack began with credential spraying against a SonicWall SSL VPN instance without multifactor authentication. According to Huntress reconstruction, roughly two hours separated the successful VPN login from the first RDP connection to the domain controller. The attacker moved fast: in under five hours from initial access, the full offensive cycle was complete.

Once on the domain controller, the attacker opened AdUsers.txt and AdComp.txt in Notepad, files produced by the Get-ADUser and Get-ADComputer commands. The Active Directory enumeration served to map the network and identify high-value targets. In parallel, the attacker archived network shares with WinRAR and uploaded the material with s5cmd, a command-line tool for S3 storage operations. This is classic double-extortion: steal first, encrypt later.

AnyDesk was installed as a Windows service to guarantee persistent remote access. Brinztech, which reworks the Huntress analysis with additional persistence details, notes the attacker preconfigured AnyDesk in the SafeBoot registry hive: the remote-access tool survives the reboot into Safe Mode, while third-party security services stay offline by design.

The Safe Mode Maneuver and the Accidental Blind Spot

The critical moment arrived when the attacker ran msconfig.exe and forced a reboot into Safe Mode with Networking. This mode starts only essential Windows drivers and services; by design, third-party services including EDR agents do not start. Huntress confirms its own agent and Microsoft Defender real-time protection were both inactive for the entire Safe Mode window.

Safe Mode, however, has a drastically reduced resource profile. Virtual memory is constrained compared to normal operational mode. When the akira.exe payload attempted to activate, the process starved for memory:

"Safe Mode boots with a stripped-down environment and constrained virtual memory, and the Akira process tree appears to have starved it, getting the 'Out of Virtual Memory' pop-up and the cascade of PowerShell hard errors line up exactly with the moment the payload tried to kick things off"
— Huntress

The system remained in Safe Mode for roughly ten minutes. The payload encrypted nothing. Defender, in a scheduled scan, detected the executable but could not remove it in Safe Mode; it quarantined akira.exe only after the attacker rebooted back into normal mode.

Why the Encryption Failure Is Not a Victory

Huntress leaves no room for optimism:

"The takeaway is a little uncomfortable. While Safe Mode blinded our controls, it may also have prevented the encryption it was meant to enable. That's a lucky side effect of the attacker's own mistake in these circumstances, not a defence you can plan around."

The quote sets the conceptual limit: the crash from memory starvation is an artifact of circumstance, not a reliable protection. Huntress adds a critical technical variable: a host with more physical RAM or a larger page file could have given akira.exe enough virtual memory to complete encryption in Safe Mode.

The most operationally relevant fact is that exfiltration was already finished. The victim keeps intact files, but the attacker keeps the copies. The ransom leverage no longer depends on encryption: the stolen data remains an independent extortion weapon regardless of the payload's fate.

What to Do Now

Recommendations derive directly from the documented incident facts:

• Enable multifactor authentication on all perimeter VPN access points: the absence of MFA on the SonicWall SSL VPN was the condition that allowed initial access.
• Monitor execution of msconfig.exe and boot configuration changes, with specific attention to Event IDs 27 and 12, which signal boot configuration changes.
• Audit the SafeBoot registry hive for anomalously added services: AnyDesk and similar remote-access tools can be preconfigured to survive a reboot into Safe Mode.
• Realign exfiltration-to-response playbooks: the attack speed, under five hours, drastically compresses the window for manual intervention before data is already off-network.

A Tactic That Won't Stay Unique

This is the first observation in Huntress telemetry of Safe Mode employed in an Akira attack. The tactic itself is not ransomware innovation; other groups have already used it. The novelty is the detailed documentation of the operational trade-off. Attackers who know EDR architectures know Safe Mode makes them invisible. They appear not to have calculated that the same minimal environment can kill their own payload through resource starvation.

The dossier's limits are significant: it does not reveal whether other Akira affiliates are already using this tactic successfully, nor whether the payload has been modified since the incident to reduce memory requirements. The specific operator's identity remains unknown, as does the exact volume of exfiltrated data and any ransom negotiation outcome.

For enterprise defenses, the lesson is counter-intuitive: do not count on the adversary's bad luck. Detection must happen in the early phases — VPN, RDP, AD enumeration — because once in Safe Mode the EDR is off and the game plays out on technical conditions the defender does not control.

Sources

• https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
• https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
• https://www.brinztech.com/breach-alerts/brinztech-alert-akira-ransomware-affiliate-blinds-edr-via-safe-mode-reboot-but-memory-starvation-stalls-payload-encryption
• https://www.bleepingcomputer.com/news/security/akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt/
• https://support.huntress.io/hc/en-us
• https://www.bleepingcomputer.com/
• https://www.bleepingcomputer.com/tutorials/
• https://www.bleepingcomputer.com/download/