Akira Hits Safe Mode: Ransomware Rebooting Around EDR

This report documents an August 2026 Akira ransomware intrusion that gained initial access through a credential-sprayed SonicWall SSL VPN lacking MFA, performed full Active Directory dumps, archived file shares with WinRAR, exfiltrated data using s5cmd to an attacker S3 bucket, and deployed akira.exe via an AnyDesk session; the operator rebooted a host into Safe Mode with Networking to disable third-party EDR/AV, which blinded defenses but caused the ransomware to fail due to virtual memory errors—reporting includes timeline, IOCs (IP, hostnames, binary/hash, AnyDesk ID), and concrete mitigations (MFA, EDR coverage, SIEM, Safe Mode monitoring).