Akira Ransomware Uses Safe Mode to Bypass EDR

Akira ransomware operators gained access via an MFA-less SonicWall VPN, exfiltrated data (Active Directory and mapped shares), then rebooted a compromised host into Safe Mode with Networking and added AnyDesk to the Safe Mode registry to disable EDR and maintain access; the Akira encryptor failed seconds after launching due to out-of-virtual-memory errors in the constrained Safe Mode environment, but the attacker’s exfiltration still enables extortion. Detection guidance highlights monitoring for bcdedit/msconfig use, Kernel Boot/General event IDs indicating Safe Mode, third-party service stops, and remote-access tools added to Safe Mode registry.