Akira gang reboots into Safe Mode to blind security tools, then fumbles the ransom
The hackers walked in through a SonicWall VPN with no second login step, but their own ransomware ran out of memory before it could lock a single file.
Key points
- An affiliate of the Akira ransomware gang broke into a company on 4 August 2025 through a SonicWall VPN account that had no second login step.
- The hackers restarted the machine into Windows Safe Mode to disable endpoint security tools, a trick borrowed from older gangs like Snatch and AvosLocker.
- Security firm Huntress says the intruders stole files and passwords in under five hours, but the ransomware itself crashed with out-of-memory errors and never encrypted anything.
- Microsoft Defender quarantined the Akira program only after the machine rebooted into normal mode.
- Huntress recommends turning on multi-factor authentication for every VPN account and alerting on any Safe Mode reboot.
An attacker linked to the Akira ransomware crew got a rare mixed result: they stole the data, but their file-scrambling program died before it could do the scrambling.
The intrusion was picked apart by Huntress, a company that watches customer networks for signs of break-ins, and first reported by BleepingComputer.
How did the hackers get in?
Through a company VPN protected by a password alone. A VPN, or virtual private network, is the encrypted tunnel staff use to reach work systems from outside the office.
The device was a SonicWall VPN appliance with no multi-factor authentication, the extra step (a code, a prompt, a hardware key) that stops a stolen password from being enough on its own. Our July report on 81 million automated login attempts against Microsoft 365 found that even accounts with MFA were compromised when it was configured incorrectly. A bare password on a public-facing VPN doesn't clear that bar.
Once inside, the attacker had about two hours of quiet reconnaissance. They reached the domain controller, the server that holds the master list of user accounts, over Remote Desktop, listed every user and machine in the network, then moved to an application server.
What did they steal?
Files from shared drives and account credentials. The attacker used WinRAR, a common file-compression tool, to bundle up mapped shared folders, then pushed the archives to an Amazon S3 cloud storage bucket they controlled using a tool called s5cmd.
After that they installed AnyDesk, a legitimate remote-support app that ransomware crews favour because it looks routine in logs, to keep a foothold on the machine.
Why did the ransomware fail?
Because the attacker outsmarted themselves. To disable the security software, they forced Windows to reboot into Safe Mode with Networking. Safe Mode is a stripped-down startup state meant for fixing broken PCs: it loads only a minimal set of Microsoft drivers and blocks most third-party programs, including the Huntress agent and Defender's real-time protection.
For ten minutes, Huntress says, the host had no working endpoint detection and response tool (the software that spots malicious behaviour) and its antivirus was blind.
The attacker added AnyDesk to a special Safe Mode registry key so their remote access would survive the reboot. Clever. Then they tried to run akira.exe.
It crashed. Low virtual memory warnings and out-of-memory errors killed the payload. Safe Mode simply didn't leave enough resources to run it.
A scheduled Defender scan later spotted akira.exe sitting on disk. Defender couldn't delete it in Safe Mode, but the moment the attacker rebooted into normal Windows, real-time protection came back and quarantined the file.
Timeline of the attack
| Time from initial access | Attacker action |
|---|---|
| 0 hours | Logged into SonicWall VPN with no MFA |
| ~2 hours | Reached domain controller over RDP |
| ~3 hours | Archived shares with WinRAR, exfiltrated to S3 |
| ~4 hours | Installed AnyDesk, rebooted into Safe Mode |
| ~5 hours | Ransomware payload failed to run |
Should ordinary customers worry?
If you're a customer of the affected business, your files weren't encrypted, but data was taken. Watch for unusual emails asking you to confirm account details, and change any password you reused elsewhere.
Huntress notes older gangs like Snatch and AvosLocker have used the Safe Mode trick for years. This is the first time Huntress observed the tactic in an Akira attack, and defenders should treat an unexpected Safe Mode reboot as a serious alert on its own. The failure here was lucky; the data theft wasn't.
