Researchers at the security firm Huntress have documented the first known case of the Akira ransomware group forcing a compromised Windows server to reboot into Safe Mode with Networking — a diagnostic boot mode that loads only a bare minimum of drivers and services — specifically to knock out the security tools running on it. Once in Safe Mode, both Huntress's own monitoring agent and Microsoft Defender's real-time protection went dark, since neither is designed to keep running in that stripped-down environment. Other ransomware crews (Snatch, Embargo, AvosLocker) have used the same trick before; this is simply the first time Akira has been caught doing it.
The attacker got in through an internet-facing SonicWall SSL VPN appliance that had no multi-factor authentication enabled, spraying credentials against it in early August before logging in cleanly. With detection blinded, they moved laterally using AnyDesk and RDP, reaching as far as a domain controller. Then came an unplanned twist: when the Akira encryptor finally ran, Safe Mode's own memory constraints caused it to crash with an "out of virtual memory" error roughly 13 seconds in, so no files were actually locked. That failure wasn't a defensive win, though — before the encryptor even launched, the attackers had already archived internal files and Active Directory data with WinRAR and pushed it out to a cloud storage bucket they controlled. The business kept its files, but lost its credentials and internal data anyway.
What this means for your business
If any VPN, firewall, or remote-access appliance in your business faces the public internet, multi-factor authentication on it isn't optional — that missing MFA, not a software flaw, is what let this attacker walk in the front door. Just as important: don't treat "we have EDR installed" as a finished sentence. Safe Mode is a legitimate, built-in Windows feature, and most endpoint protection tools simply can't run inside it by design, which is exactly why attackers keep reaching for it. Ask whoever manages your IT whether Safe Mode boots are restricted or at least logged and alerted on for servers and key workstations — an unexpected reboot into Safe Mode is a strong signal something is wrong, not routine maintenance. And remember that "the ransomware failed" is not the same as "we're fine": in this case the real damage, stolen credentials and internal data, happened well before the encryption attempt that made headlines.