Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

Huntress details an Akira ransomware affiliate intrusion where credential spraying against an unprotected SonicWall VPN led to RDP access, Active Directory enumeration, file theft (exfiltrated via s5cmd), and an attempted EDR-evasion by rebooting the host into Safe Mode; the Safe Mode boot blinded security agents but unexpectedly caused memory errors that prevented the ransomware from encrypting files. The post highlights this Safe Mode boot (MITRE T1688) as an EDR-impairing technique, warns that future variants could succeed, and provides detection and mitigation guidance including MFA, VPN hardening, monitoring for Safe Mode boot indicators, EDR deployment, and log ingestion.