Akira Ransomware's New Trick: Safe Mode Attack That Bypasses Security

Emily Davis · 2026-08-13

You'd think that after years of ransomware attacks, we'd have seen it all. But the Akira crew just proved that's not the case with a move that's both clever and terrifying. They found a way to disable endpoint detection and response (EDR) tools by restarting the compromised machine into Safe Mode with Networking. That's right—the very mode you'd use to troubleshoot a stubborn PC is now a weapon in the attacker's arsenal. Here's the kicker: they managed to steal sensitive data, but they failed to encrypt the victim's files. That's a strange outcome, and it tells us a lot about how these attacks are evolving. Let's break down what happened, why Safe Mode is such a sneaky attack vector, and what you can do to protect your systems. ### The Safe Mode Exploit: How It Works When a computer boots into Safe Mode, the operating system loads only the essential drivers and services. That's great for fixing problems, but it also means security software—like EDR agents—doesn't start. The Akira affiliate exploited this by restarting the infected machine with a command that forced it into Safe Mode with Networking. Once the system came back up, the EDR was effectively blind. No real-time monitoring, no threat detection, no alerts. The attacker had a clear path to move laterally, dump credentials, and exfiltrate data without any digital watchdog barking. The technique isn't brand new—security researchers have seen similar tricks for years—but it's becoming more common because it's surprisingly effective. And the fact that a ransomware group is using it shows that threat actors are paying close attention to how enterprise defenses work. ### Why the Encryption Failed (and What That Means) Here's the twist: despite all that effort to disable security, the encryption part of the attack didn't succeed. That's not typical for ransomware. Usually, encryption is the main event. But in this case, the data theft was successful while the file-locking step fell flat. There are a few possible reasons for that. Maybe the attacker hit a technical snag, or maybe they were interrupted. It's also possible that the target's backup strategy kicked in, making encryption less impactful. Either way, the lesson is clear: data theft is becoming the primary goal, with encryption as a secondary tactic. That shift matters because it changes the game. If attackers can steal your data without encrypting it, they can still threaten to leak it if you don't pay. That's a growing trend in the ransomware world, and it makes prevention even more critical. ### What This Means for Your Security Posture So, what should you take away from this? First, don't assume your EDR is invincible. It's a powerful tool, but it has blind spots. Safe Mode is one of them. Here are a few practical steps to reduce your risk: - **Restrict Safe Mode access** through Group Policy or MDM settings where possible. - **Monitor for unexpected reboots** and investigate any system that comes back up in Safe Mode. - **Use EDR solutions** that have tamper protection and can report on boot configuration changes. - **Segment your network** so that even if one machine is compromised, the attacker can't easily move sideways. - **Test your incident response plan** to ensure you can detect and respond to attacks that bypass traditional defenses. ### The Bottom Line Akira's Safe Mode trick is a reminder that attackers will always look for the path of least resistance. They don't care about your security stack; they care about getting in and getting out. The fact that they failed to encrypt in this case doesn't mean they'll fail next time. Stay vigilant, keep your systems patched, and don't rely on any single security layer. The threat landscape is shifting, and your defenses need to shift with it. If you're using an antidetect browser or managing multiple online identities, remember that the same principles apply: layered security and constant awareness are your best friends.