August 20, 2026 • 5 mins
Got a question or comment? Message us here!
Akira ransomware operators have demonstrated how abusing Windows Safe Mode can effectively disable or bypass endpoint detection and response (EDR) tools, underscoring the need for defenders to harden recovery environments, monitor Safe Mode activity, and implement layered detection controls that remain effective even during system startup changes.
Watch full episodes at youtube.com/@aliascybersecurity.
Listen on Apple Podcasts, Spotify and anywhere you get your podcasts.
Listen
Watch
Mark as Played
Transcript
Episode Transcript
Available transcripts are automatically generated. Complete accuracy is not guaranteed.
SPEAKER_00 (00:02):
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of the SOC
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host Andrew, and todaywe're going to discuss a recent
and very practical ransomwaretactic that security researchers
(00:24):
observed last week.
An Akira ransomware affiliateforced a compromised Windows
system into safe mode withnetworking in order to disable
endpoint detection and responsetools before attempting to
encrypt the machine.
We'll discuss how the attackunfolded, why this technique is
effective, and the concretesteps your SOC can take to
detect and disrupt it.
(00:44):
So Akira remains one of the moreactive ransomware as a service
operations.
In this particular incident, theattackers gained initial access
through an MFA-less SonicWallVPN, and we tend to see that a
lot.
Once inside, they quicklyconnected to a domain controller
via RDP, did active directoryenumeration, and then did data
(01:06):
collection with WinRAR.
They then exfiltrated to anattacker-controlled S3 bucket
using the S5 CMD tool, and theyalso installed any desk for
persistence.
And what made this case standout is what came next.
The threat actors used MSconfigto force the system to reboot
into safe mode with networking.
(01:27):
For those unfamiliar, safe modeloads only a minimal set of
drivers and services, whichmeans most third-party EDR
agents and even MicrosoftDefender's real-time protection
do not start.
For roughly 10 minutes, the hostwas effectively blind from a
security monitoring perspective.
The attackers even registeredany desk under the SafeMode
(01:49):
Registry keys, so their remoteaccess survived the reboot.
Ironically, the same constrainedenvironment that blinded the
defenses also caused the Akiraencryptor to fail.
The payload ran into anout-of-virtual memory error and
never completed encryption.
A scheduled defender scan laterdetected the ransomware binary,
(02:09):
and once the system returned tonormal mode, the file was
quarantined.
But data had already beenstolen, and so the extortion
risk remained.
And this all matters becausesafe mode boot is a known
defense evasion technique, andother ransomware families have
used it for years.
But this one appears to be thefirst time security researchers
observed Akira employing it.
(02:30):
When attackers can temporarilydisable your primary endpoint
protections, the window fordetection and response shrinks
dramatically.
Even when encryption fails, thedata exfiltration stage of
modern double extortion tacticsis often complete before the
reboot.
For SOCS, detecting this attackis going to start with
monitoring for execution ofmsconfig.exe or the bcd
(02:52):
edit.exe, especially whenfollowed by a reboot.
You can look for kernel bootevent ID 27 that includes a safe
boot load option, kernel generalevent ID 12 showing boot mode 2,
and system event ID 7036indicating third-party security
services stopping.
Also watch for new entries beingadded under the Safe Boot
(03:14):
Registry keys, as those are allsignals or signs to give you a
chance to get alerted on thatactivity before or during the
blind window.
On the prevention side, makesure you're enforcing MFA on all
remote access tools, especiallyVPN appliances, and treat
internet facing managementinterfaces as high value
targets.
And we always recommenddisabling those completely if
(03:37):
able.
Ensure your EDR agents aredeployed and healthy across the
environment, and consideradditional controls that can
still provide some visibility oralerting even when real-time
protection is offline.
Make sure you're restricting whocan modify boot configuration
and safe mode settings onendpoints.
For threat hunting, searchrecent logs for safe mode boots,
(03:58):
anydesk, or other remote accesstools registered under Safe Boot
Keys, and any unusual use oftools like S5 CMD or WinRAR
against file shares.
You can also integrate thelatest Acura and related IOCs
into your detection rules so youcan catch the early stages of
the attack chain.
And the bottom line here is thatthis Acura safe mode case shows
(04:21):
that ransomware operatorscontinue to look for ways to
bypass endpoint protections.
Socks that monitor bootconfiguration changes and treat
unexpected safe mode activity asa high priority signal have a
much better chance ofinterrupting these attacks
before encryption happens, or atleast before the full impact is
realized.
So here's some closing thoughtsand a call to action.
(04:42):
Akira's use of safe mode toblind EDR is a reminder that
even well-known techniques canstill catch organizations off
guard when applied by activeransomware groups.
SOCs need to watch for thebehavioral precursors like boot
configuration changes,unexpected reboots into safe
mode, and registry modificationsto help shrink the attacker's
window of opportunity.
(05:04):
This week I challenge everyoneto review your detection
coverage for safe mode and bootrelated events, and verify that
MFA is being enforced on all VPNand remote access solutions.
Run one quick hunt for a recentMS config or BCD edit activity,
and anything that seems out ofplace, share that with your
team.
(05:24):
That's a wrap for this episodeof the SOC Brief.
If you have questions or ownransomware evasion stories, hit
us up on social media or via ourwebsite.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
And as always, stay secure outthere.
Bye.
Good morning, good afternoon, or good evening,
whenever you may be, and welcometo another episode of the SOC
Brief.
This is your go-to podcast forstaying ahead of the
ever-evolving world ofcybersecurity threats.
I'm your host Andrew, and todaywe're going to discuss a recent
and very practical ransomwaretactic that security researchers
(00:24):
observed last week.
An Akira ransomware affiliateforced a compromised Windows
system into safe mode withnetworking in order to disable
endpoint detection and responsetools before attempting to
encrypt the machine.
We'll discuss how the attackunfolded, why this technique is
effective, and the concretesteps your SOC can take to
detect and disrupt it.
(00:44):
So Akira remains one of the moreactive ransomware as a service
operations.
In this particular incident, theattackers gained initial access
through an MFA-less SonicWallVPN, and we tend to see that a
lot.
Once inside, they quicklyconnected to a domain controller
via RDP, did active directoryenumeration, and then did data
(01:06):
collection with WinRAR.
They then exfiltrated to anattacker-controlled S3 bucket
using the S5 CMD tool, and theyalso installed any desk for
persistence.
And what made this case standout is what came next.
The threat actors used MSconfigto force the system to reboot
into safe mode with networking.
(01:27):
For those unfamiliar, safe modeloads only a minimal set of
drivers and services, whichmeans most third-party EDR
agents and even MicrosoftDefender's real-time protection
do not start.
For roughly 10 minutes, the hostwas effectively blind from a
security monitoring perspective.
The attackers even registeredany desk under the SafeMode
(01:49):
Registry keys, so their remoteaccess survived the reboot.
Ironically, the same constrainedenvironment that blinded the
defenses also caused the Akiraencryptor to fail.
The payload ran into anout-of-virtual memory error and
never completed encryption.
A scheduled defender scan laterdetected the ransomware binary,
(02:09):
and once the system returned tonormal mode, the file was
quarantined.
But data had already beenstolen, and so the extortion
risk remained.
And this all matters becausesafe mode boot is a known
defense evasion technique, andother ransomware families have
used it for years.
But this one appears to be thefirst time security researchers
observed Akira employing it.
(02:30):
When attackers can temporarilydisable your primary endpoint
protections, the window fordetection and response shrinks
dramatically.
Even when encryption fails, thedata exfiltration stage of
modern double extortion tacticsis often complete before the
reboot.
For SOCS, detecting this attackis going to start with
monitoring for execution ofmsconfig.exe or the bcd
(02:52):
edit.exe, especially whenfollowed by a reboot.
You can look for kernel bootevent ID 27 that includes a safe
boot load option, kernel generalevent ID 12 showing boot mode 2,
and system event ID 7036indicating third-party security
services stopping.
Also watch for new entries beingadded under the Safe Boot
(03:14):
Registry keys, as those are allsignals or signs to give you a
chance to get alerted on thatactivity before or during the
blind window.
On the prevention side, makesure you're enforcing MFA on all
remote access tools, especiallyVPN appliances, and treat
internet facing managementinterfaces as high value
targets.
And we always recommenddisabling those completely if
(03:37):
able.
Ensure your EDR agents aredeployed and healthy across the
environment, and consideradditional controls that can
still provide some visibility oralerting even when real-time
protection is offline.
Make sure you're restricting whocan modify boot configuration
and safe mode settings onendpoints.
For threat hunting, searchrecent logs for safe mode boots,
(03:58):
anydesk, or other remote accesstools registered under Safe Boot
Keys, and any unusual use oftools like S5 CMD or WinRAR
against file shares.
You can also integrate thelatest Acura and related IOCs
into your detection rules so youcan catch the early stages of
the attack chain.
And the bottom line here is thatthis Acura safe mode case shows
(04:21):
that ransomware operatorscontinue to look for ways to
bypass endpoint protections.
Socks that monitor bootconfiguration changes and treat
unexpected safe mode activity asa high priority signal have a
much better chance ofinterrupting these attacks
before encryption happens, or atleast before the full impact is
realized.
So here's some closing thoughtsand a call to action.
(04:42):
Akira's use of safe mode toblind EDR is a reminder that
even well-known techniques canstill catch organizations off
guard when applied by activeransomware groups.
SOCs need to watch for thebehavioral precursors like boot
configuration changes,unexpected reboots into safe
mode, and registry modificationsto help shrink the attacker's
window of opportunity.
(05:04):
This week I challenge everyoneto review your detection
coverage for safe mode and bootrelated events, and verify that
MFA is being enforced on all VPNand remote access solutions.
Run one quick hunt for a recentMS config or BCD edit activity,
and anything that seems out ofplace, share that with your
team.
(05:24):
That's a wrap for this episodeof the SOC Brief.
If you have questions or ownransomware evasion stories, hit
us up on social media or via ourwebsite.
Keep your eyes open, keepsharpening those skills, and
we'll talk soon.
And as always, stay secure outthere.
Bye.
Popular Podcasts
Stuff You Should Know
If you've ever wanted to know about champagne, satanism, the Stonewall Uprising, chaos theory, LSD, El Nino, true crime and Rosa Parks, then look no further. Josh and Chuck have you covered.
Dateline NBC
Current and classic episodes, featuring compelling true-crime mysteries, powerful documentaries and in-depth investigations. Follow now to get the latest episodes of Dateline NBC completely free, or subscribe to Dateline Premium for ad-free listening and exclusive bonus content: DatelinePremium.com
The Breakfast Club
The World's Most Dangerous Morning Show, The Breakfast Club, With DJ Envy, Jess Hilarious, And Charlamagne Tha God!