Akira Ransomware's Clever Trick: Safe Mode Attack Bypasses Security

Michael Miller · 2026-08-13

You'd think that once you've got solid endpoint detection and response (EDR) software installed on your network, you're pretty much covered. But a recent attack by an Akira ransomware affiliate shows just how creative cybercriminals can be when they want to slip past your defenses. The twist? They didn't use some fancy zero-day exploit or a complex code injection. Instead, they simply restarted the compromised machine in Safe Mode with Networking. That's it. A built-in Windows feature, normally used for troubleshooting, became the perfect cloak for their malicious activity. It's a reminder that sometimes the most effective attacks aren't the most sophisticated ones—they're the ones that exploit the simple, everyday tools we all take for granted. ### The Safe Mode Loophole Safe Mode is designed to load only the essential drivers and services needed to run Windows. This is great for fixing a broken system, but it also means that your security software, like EDR, doesn't load at startup. The Akira affiliate knew this and used it to their advantage. By booting into Safe Mode with Networking, they were able to: - Disable the EDR solution without triggering any alerts - Run their data-stealing tools in a relatively quiet environment - Maintain network connectivity to exfiltrate the stolen data Essentially, they turned off the alarm system before walking in the front door. The EDR software, which would normally catch their actions, was simply not running. ### Data Theft, But No Encryption Here's where the story gets interesting. The attackers successfully stole sensitive data. They got what they came for. But then, something went wrong on their end. They failed to encrypt the victim's files. This is a significant deviation from the typical ransomware playbook. Usually, the goal is to encrypt your data and then demand a ransom for the decryption key. In this case, the affiliate got the data but couldn't seal the deal on the encryption part. Why might this happen? It could be a technical glitch, a mistake in their script, or maybe the encryption tool didn't work in the Safe Mode environment as expected. Regardless, the victim was left with a data breach but not a locked-out system. It's a strange silver lining, but it highlights that even the bad guys aren't always perfect. ### What This Means for Your Business This attack vector is a serious concern for any organization relying on EDR as their primary defense. It's not about whether your EDR is good or bad; it's about the fact that it can be completely bypassed with a simple reboot. Here's what you should consider doing to bolster your defenses: - **Enforce a BIOS/UEFI password:** This can prevent someone from easily changing boot options to enter Safe Mode. - **Use tamper protection:** Many EDR solutions have a feature that prevents unauthorized changes to the software itself. - **Monitor for unusual reboots:** Keep an eye out for systems that are restarting at odd hours, especially into Safe Mode. - **Implement application control:** Restrict which programs can run, making it harder for attackers to execute their tools. ### The Bigger Picture This incident is a reminder that security is a layered game. No single tool is a silver bullet. The Akira affiliate didn't break the EDR; they just found a way to work around it. They used a legitimate feature against the system. The fact that they failed to encrypt the files is a small win for the victim, but the stolen data is still a major problem. Data breaches can lead to regulatory fines, legal trouble, and a massive hit to your reputation. So, what's the takeaway here? Don't get complacent. Keep your security stack diverse and don't rely solely on one solution. A robust security posture includes good hygiene, user training, and multiple layers of defense. For security teams, this is a wake-up call to think like an attacker. Ask yourself: if I wanted to get in, how would I do it? Sometimes the answer isn't a new exploit; it's just a different way of using an old one. Stay vigilant, and make sure your defenses are ready for the unexpected.