As reported by Security Affairs, an Akira ransomware affiliate recently demonstrated a calculated technique to sidestep endpoint detection and response (EDR) tools by rebooting victim systems into Safe Mode with Networking — effectively disabling security software before deploying the encryptor payload. While the encryption attempt failed due to memory issues in this particular incident, security teams should not mistake a failed execution for a diminished threat. The tactic itself is the story.

Ransomware Alert: As reported by Security Affairs, an Akira ransomware affiliate recently demonstrated a calculated technique to sidestep endpoint detection and response (EDR) tools by rebooting victim systems into Safe Mode with Networking — effectively disabling security software before deploying the encryptor payload.

Why This Tactic Is More Dangerous Than It Appears

Safe Mode has long been a blind spot in enterprise security architectures. When Windows boots into Safe Mode, it loads only a minimal set of drivers and services — and most third-party security agents, including EDR solutions, are explicitly excluded from that list. Attackers have known this for years, but seeing it integrated into a structured ransomware affiliate playbook signals maturation. This isn't opportunistic exploitation; it's a deliberate operational step in a kill chain that began with credential theft and lateral movement.

The entry vector here compounds the concern: an MFA-less SonicWall VPN. In 2025, deploying remote access infrastructure without multi-factor authentication is an organizational risk that is frankly indefensible. VPN endpoints remain one of the most targeted initial access vectors across all ransomware families, and Akira has a well-documented history of exploiting SonicWall vulnerabilities and misconfigurations.

Shield53 Perspective: The failed encryption in this case was luck, not resilience. Organizations that consider a failed ransomware deployment a "near miss" and move on without deeper remediation are setting themselves up for a successful follow-up attack.

Who Is at Risk

Why This Tactic Is More Dangerous Than It Appears
SMBs and mid-market enterprises relying on perimeter VPN solutions without compensating controls (MFA, conditional access, device posture checks)
Organizations running EDR-only endpoint strategies with no visibility into Safe Mode activity or boot-time behavior
Environments using SonicWall VPN without current firmware and without MFA enforced at the gateway level
IT teams without hardened Safe Mode policies — many organizations have never considered restricting or monitoring Safe Mode reboots at scale

The Broader EDR Evasion Trend

This Safe Mode technique isn't new in isolation — it has appeared in threat actor playbooks previously — but its inclusion in an Akira affiliate's operational workflow reflects a broader industry trend: ransomware groups are systematically cataloging and exploiting the architectural limitations of defensive tooling. We've seen similar approaches with BYOVD (Bring Your Own Vulnerable Driver) attacks to kill EDR processes, and abuse of legitimate tools like Process Hacker. The attack surface for EDR evasion is growing, and defenders cannot rely on a single layer of endpoint protection.

Security teams need to shift from asking "does our EDR catch ransomware?" to "what happens to our detection capability when EDR is intentionally removed from the equation?"

Shield53 Recommendations

Immediate Actions

  • Enforce MFA on all VPN and remote access solutions immediately — no exceptions. If your SonicWall or any remote access gateway lacks MFA, treat it as a critical open vulnerability today.
  • Audit Safe Mode access controls — use Group Policy to restrict Safe Mode boots where operationally feasible, and ensure your EDR vendor supports Safe Mode persistence or boot-time monitoring.
  • Monitor for Safe Mode reboot commands — detection rules should alert on bcdedit modifications and shutdown /r /f with Safe Mode flags (e.g., safeboot registry key modifications under HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot).
  • Patch SonicWall firmware and review CISA's Known Exploited Vulnerabilities catalog for any applicable SonicWall CVEs in your environment.

Strategic Controls

  • Implement network segmentation to limit lateral movement even after initial access — credential theft enabling file share access suggests flat network architecture.
  • Deploy decoy credentials and honeypot shares to detect adversarial enumeration before encryption attempts occur.
  • Test your incident response playbook specifically against Safe Mode evasion scenarios — tabletop this as an attack variant in your next IR exercise.
  • Evaluate EDR vendors on Safe Mode resilience — ask your vendor directly whether their agent persists through Safe Mode boots and what telemetry is available in that state.

The Akira group continues to evolve, and its affiliates are clearly investing in tradecraft that specifically targets the gaps between security tools. Defenders need to match that investment with equally deliberate architecture reviews — starting with the fundamentals that this attack exploited.