Akira gang reboots into Safe Mode to blind security tools, then fumbles the ransom
The hackers walked in through a SonicWall VPN with no second login step, but their own ransomware ran out of memory before it could lock a single file.
Key points
- An affiliate of the Akira ransomware gang broke into a company on 4 August 2025 through a SonicWall VPN account that had no second login step.
- The hackers restarted the machine into Windows Safe Mode to switch off the endpoint security tools, a trick borrowed from older gangs like Snatch and AvosLocker.
- Security firm Huntress says the intruders stole files and passwords in under five hours, but the ransomware itself crashed with out-of-memory errors and never encrypted anything.
- Microsoft Defender quarantined the Akira program only after the machine was rebooted back to normal mode.
- Huntress recommends turning on multi-factor authentication for every VPN account and alerting on any Safe Mode reboot.
An attacker linked to the Akira ransomware crew got a rare mixed result this month: they stole the data, but their file-scrambling program died before it could do the scrambling.
The intrusion was picked apart by Huntress, a company that watches customer networks for signs of break-ins, and first reported by BleepingComputer.
How did the hackers get in?
Through a company VPN that was protected by a password alone. A VPN, or virtual private network, is the encrypted tunnel staff use to reach work systems from outside the office.
The device in question was a SonicWall VPN appliance. It had no multi-factor authentication, the extra step (a code, a prompt, a hardware key) that stops a stolen password from being enough on its own.
Once the attacker logged in, they had about two hours of quiet reconnaissance before things escalated. They hopped to the domain controller, the server that holds the master list of user accounts, using Remote Desktop. From there they listed every user and machine in the network and moved on to an application server.
Would MFA have helped here? Honestly, yes. This is the textbook case for it.
What did they steal?
Files from shared drives, and account credentials. The attacker used WinRAR, a common file-compression tool, to bundle up mapped shared folders, then a program called s5cmd to push the archives up to an Amazon S3 cloud storage bucket they controlled.
After that they installed AnyDesk, a legitimate remote-support app that ransomware crews love because it looks innocent in logs, to keep a foothold on the machine.
Why did the ransomware fail?
Because the attacker outsmarted themselves. To disable the security software watching the machine, they told Windows to reboot into Safe Mode with Networking. Safe Mode is a stripped-down startup state meant for fixing broken PCs. It loads only a handful of Microsoft drivers and blocks most third-party programs, including, conveniently, the Huntress agent and Microsoft Defender's real-time protection.
For ten minutes, Huntress says, the machine had no working endpoint detection and response tool (the software that spots malicious behaviour) and its antivirus was blind.
The attacker added AnyDesk to a special Safe Mode registry key so their remote access would survive the reboot. Clever. Then they tried to run akira.exe, the actual ransomware.
It crashed. The system threw low virtual memory warnings, out-of-memory errors, and PowerShell failures. Safe Mode simply did not have enough resources to run the payload.
A scheduled Defender scan later spotted the akira.exe file sitting on disk. Defender could not delete it in Safe Mode, but the moment the attacker rebooted into normal Windows, real-time protection came back and quarantined the file.
Timeline of the attack
| Time from initial access | Attacker action |
|---|---|
| 0 hours | Logged into SonicWall VPN with no MFA |
| ~2 hours | Reached domain controller over RDP |
| ~3 hours | Archived shares with WinRAR, exfiltrated to S3 |
| ~4 hours | Installed AnyDesk, rebooted into Safe Mode |
| ~5 hours | Ransomware payload failed to run |
Should ordinary customers worry?
If you are a customer of the affected business, your files were not encrypted, but data was taken. Watch for unusual emails asking you to confirm account details, and change any password you reused elsewhere.
Huntress notes older gangs like Snatch and AvosLocker have used the Safe Mode trick for years. This is the first time the tactic has shown up in an Akira case, and defenders should now treat an unexpected Safe Mode reboot as a serious alert on its own.
