An Akira ransomware affiliate accidentally sabotaged their own encryption malware while trying to disable a victim's security tools, according to an incident report published Wednesday by Huntress security operations analyst James Northey. The attacker forced the compromised computer to restart in Safe Mode with Networking to kill endpoint detection and response products, but the limited-function boot environment also broke their ransomware encryptor, which couldn't run in the constrained memory conditions. While the victim avoided encryption, the criminal had already exfiltrated credentials and file share data before the malware failure occurred.

The intrusion began on August 4 when attackers launched a credential-spray attack against a SonicWall SSL VPN, logging a burst of failed login attempts that were blocked. Seven minutes later, one attempt succeeded using a valid VPN account that lacked multi-factor authentication protection. After gaining access, the criminal used Remote Desktop Protocol to reach the domain controller and queried Active Directory for detailed information about users, groups, computers, and network structure. The attacker then moved to an application server, downloaded WinRAR to archive mapped file shares, and sent stolen data to cloud storage using s5cmd, a fast S3 transfer utility. They also installed AnyDesk remote desktop software configured to launch at Windows startup, abusing the legitimate tool as a remote-access trojan and command-and-control channel to drop the akira.exe ransomware binary.

About three hours into the intrusion, the attacker forced the machine to reboot into Safe Mode with Networking, which loads only essential drivers and services while blocking most third-party software. The restart stopped the Huntress agent and disabled Microsoft Defender's real-time protection, giving the attacker what Northey described as their "blind window." But thirteen seconds after the reboot, the computer began generating memory errors. According to Northey, "Akira's encryptor is engineered for speed, relying on concurrent worker threads and heavy memory mapping," and Safe Mode's minimal driver set restricts storage controllers and pagefile availability, causing the high-performance design to fail. Huntress had never observed Akira affiliates using Safe Mode boot tactics until this incident, though other ransomware families including Snatch and AvosLocker have employed the technique for years.

Northey cautioned that this shouldn't be viewed as a reliable defense against Akira ransomware. The report notes that a host with more physical memory or a larger page file might provide enough virtual memory for the encryptor to function in Safe Mode, and Akira's developers or affiliates could retool the malware to reduce memory demands or improve Safe Mode launch reliability. The report emphasizes enabling multi-factor authentication on all VPN accounts and recommends organizations alert on boot-configuration changes and Safe Mode boots by monitoring msconfig.exe or bcdedit activity, Kernel-Boot event ID 27 with SAFEBOOT load options, Kernel-General event ID 12 with BootMode=2, and third-party security services stopping. Organizations should also watch for tools being added to the Safe Mode minimal-service registry list to detect this tactic before encryption attempts succeed. The protective effect in this case may have reflected luck more than a systemic weakness—the attacker still achieved data theft despite the encryption failure. Security teams that rely on endpoint constraints rather than hardened authentication and monitoring may find themselves declaring tactical victories while strategic losses compound invisibly.