Akira Ransomware Safe Mode Attack: What You Need to Know
A sophisticated Akira ransomware Safe Mode attack technique has emerged as a critical threat to Australian businesses, demonstrating how cybercriminals are evolving their methods to bypass modern security controls. In this recent incident, an Akira affiliate successfully disabled endpoint detection and response (EDR) protections by exploiting Windows Safe Mode, exfiltrating sensitive data before their encryption attempt ultimately failed.
This attack highlights a concerning trend: threat actors are increasingly targeting the security tools designed to stop them. For organisations relying solely on EDR solutions, this incident serves as a wake-up call about the importance of layered security defences.
Source: BleepingComputer — “An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking.”
What Happened in the Akira Ransomware Safe Mode Attack?
The attack followed a methodical approach that security teams should understand to better defend their environments. The Akira affiliate gained initial access to the target network and identified that EDR software was actively monitoring system activity and blocking malicious behaviour.
Rather than attempting to directly disable or uninstall the security software—actions that would typically trigger alerts—the attacker exploited a fundamental Windows feature. They configured the compromised system to boot into Safe Mode with Networking, a diagnostic mode where most third-party services, including many EDR agents, fail to load.
Once the system restarted in Safe Mode, the attacker operated with significantly reduced security oversight. This allowed them to:
- Move laterally through the network undetected
- Locate and exfiltrate sensitive business data
- Prepare ransomware deployment without EDR interference
- Establish persistence mechanisms for future access
Interestingly, while the data theft succeeded, the encryption phase of the attack failed—though the exact reason remains unclear from available reports.
How Does the Safe Mode EDR Bypass Work?
Understanding the technical mechanics of this Akira ransomware Safe Mode technique is essential for security professionals. Windows Safe Mode is designed to start the operating system with minimal drivers and services, allowing administrators to troubleshoot system issues.
The Technical Attack Chain
The attack exploits a significant security gap in how many EDR solutions operate:
- Initial Compromise — The attacker gains administrative privileges through credential theft, phishing, or exploitation
- Registry Modification — They modify boot configuration settings to enable Safe Mode with Networking
- Forced Reboot — The system is restarted, loading into the diagnostic environment
- EDR Neutralisation — Most EDR agents fail to start as they’re not registered as Safe Mode-compatible services
- Malicious Activity — With security tools dormant, the attacker executes their objectives freely
Why Most EDR Solutions Are Vulnerable
Many endpoint protection platforms are not configured to run in Safe Mode by default. This design choice exists because Safe Mode is intended for troubleshooting, and running complex security software could interfere with diagnostic activities. However, this creates a blind spot that sophisticated attackers like Akira affiliates actively exploit.
What Is the Business Impact of EDR Bypass Attacks?
The consequences of this attack technique extend far beyond the immediate technical compromise. For Australian businesses, particularly those subject to Privacy Act obligations and the Notifiable Data Breaches scheme, data exfiltration creates significant regulatory and reputational risks.
Key business impacts include:
- Data breach notification requirements — Stolen data may trigger mandatory reporting obligations
- Regulatory penalties — OAIC can impose substantial fines for inadequate security controls
- Operational disruption — Investigation and remediation consume significant resources
- Reputational damage — Customer trust erodes following publicised breaches
- Extortion risk — Akira operators may still threaten to leak stolen data despite failed encryption
Even though encryption failed in this instance, the double extortion model means victims still face data exposure threats. Akira operators maintain a leak site where they publish stolen data from organisations that refuse to pay ransoms.
How to Protect Your Business from Safe Mode Ransomware Attacks
Defending against this Akira ransomware Safe Mode technique requires a multi-layered approach. Organisations cannot rely on a single security control when attackers demonstrate the ability to circumvent it.
Immediate Technical Controls
- Configure EDR for Safe Mode operation — Work with your vendor to ensure agents load during Safe Mode boot sequences
- Monitor boot configuration changes — Alert on registry modifications to BCD (Boot Configuration Data) settings
- Restrict administrative privileges — Implement least-privilege access to prevent unauthorised system configuration changes
- Deploy network segmentation — Limit lateral movement even if endpoint controls are bypassed
Strategic Security Measures
Beyond immediate technical fixes, organisations should consider comprehensive vulnerability management services to identify and address security gaps before attackers exploit them.
- Implement 24/7 security monitoring — Detect unusual system reboots and administrative actions
- Deploy backup protections — Ensure backups are immutable and isolated from primary networks
- Conduct regular penetration testing — Validate that security controls withstand real-world attack techniques
- Develop incident response plans — Prepare for scenarios where primary security tools are compromised
Frequently Asked Questions
What is the Akira ransomware group?
Akira is a ransomware-as-a-service (RaaS) operation that emerged in March 2023. The group operates using a double extortion model, stealing sensitive data before encrypting systems and threatening to publish stolen information on their leak site if victims refuse to pay. Akira affiliates have targeted organisations across multiple sectors, including healthcare, finance, and critical infrastructure.
How can I check if my EDR runs in Safe Mode?
Contact your EDR vendor to confirm whether their agent is configured to operate during Safe Mode boot sequences. Many vendors now offer this capability but it may require specific configuration. You can also test by manually booting a non-production system into Safe Mode and verifying the EDR service status. If your current solution lacks Safe Mode protection, consider this a critical gap requiring immediate attention.
What should I do if I suspect an Akira ransomware attack?
Immediately isolate affected systems from the network to prevent lateral movement. Do not restart systems, as this may trigger further malicious activity or destroy forensic evidence. Engage your incident response team or speak with our security team for expert assistance. Document all observations and preserve logs for investigation and potential law enforcement involvement.
Key Takeaways
- Akira affiliates are actively exploiting Safe Mode to disable EDR protections
- Data exfiltration succeeded despite failed encryption, maintaining extortion leverage
- Many EDR solutions do not operate in Windows Safe Mode by default
- Organisations must implement layered defences beyond single-point security solutions
- Monitoring for boot configuration changes can provide early attack detection
- Australian businesses face regulatory obligations following data theft incidents
Conclusion: Evolving Threats Demand Adaptive Defences
The Akira ransomware Safe Mode attack technique demonstrates that threat actors continuously innovate to bypass security controls. While EDR solutions remain valuable components of a security strategy, this incident proves they cannot be the sole line of defence.
Australian organisations must adopt a defence-in-depth approach, combining technical controls, continuous monitoring, and proactive threat hunting to detect and respond to sophisticated attacks. The fact that encryption failed in this case offers little comfort—the stolen data still poses significant risks to the victim organisation.
As cybercriminals refine their tactics, security strategies must evolve accordingly. Regular security assessments, vendor engagement about Safe Mode capabilities, and comprehensive incident response planning are no longer optional—they’re essential for organisational resilience in 2026 and beyond.