"This is classic double extortion activity: steal all the victims' files before encrypting them, so if the victim doesn't pay the ransom, they can threaten to post them on some sketchy underground forum or a darknet leak site," said Huntress.
Akira affiliate's initial access: SonicWall SSL VPN via credential spraying
Huntress reported that an Akira ransomware affiliate struck a victim in early August after gaining initial access through credential spraying against a SonicWall SSL VPN that had no multifactor authentication (MFA) deployed. From that VPN foothold the attacker used Remote Desktop Protocol (RDP) to reach the domain controller and began Active Directory enumeration — steps Huntress described as following "a similar playbook to many Akira attacks."
Data theft and cloud staging with s5cmd
Following enumeration, the actor moved to an application server and collected files, moving those files to cloud storage using s5cmd, a fast S3 transfer utility. Huntress framed that activity as the evidence of double extortion: exfiltrate broadly so the victim can be coerced even if they refuse to pay the encryption ransom.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverageSafe Mode reboot to blind EDR — and an unexpected failure
Before deploying the ransomware payload, the affiliate ran msconfig.exe and forced the machine to reboot into "Safe Mode with Networking." Huntress noted that in Safe Mode third‑party services, including the Huntress agent, do not start; Microsoft Defender real‑time protection was also down. "For the entire Safe Mode window, the host had no working EDR, and AV was blinded," the firm wrote.
Huntress linked the maneuver to a known MITRE ATT&CK technique — listed as T1688, "Impair Defences: Safe Mode Boot" — and said the tactic has been associated with groups like Snatch and AvosLocker "for years." Huntress added that this was the first time they had observed the technique used in an Akira intrusion.
Out of virtual memory: the attacker’s own evasion step caused the failure
The Safe Mode step had an unintended consequence: Safe Mode boots run with a stripped‑down environment and constrained virtual memory. Huntress reported that when the Akira encryptor attempted to run it encountered host memory errors — an "Out of Virtual Memory" pop‑up and a cascade of PowerShell hard errors that lined up precisely with the moment the payload tried to kick off. In this incident, those errors appear to have prevented the ransomware from successfully encrypting the host.
Huntress stressed that this was a fortuitous side effect of the attacker’s own choice, not a reliable defensive tactic. They warned that a host with more physical memory or a larger page file might give akira.exe enough virtual memory to complete encryption in Safe Mode, and that Akira developers or affiliates could retool the encryptor to reduce memory demands or improve its Safe Mode launch sequence.
Huntress's operational guidance for defenders
- Block credential spray attacks by alerting on bursts of failed VPN logins from a single source
- Correlate failed attempts with a successful login from the same IP or ASN shortly after
- Deploy MFA on every VPN account and disable or IP‑allowlist the SSL VPN during attacks
- If compromised, rotate all AD and VPN credentials
- Use EDR on every host, as preparation often happens on unmonitored hosts
- Deploy SIEM and ingest VPN and Windows Event Logs, as these provide an early warning before ransomware detonation
- Watch for the "Safe Mode play" by flagging the following boot‑configuration changes and Safe Mode boots: "msconfig.exe / bcdedit activity, Kernel‑Boot EID 27 with a SAFEBOOT load option, Kernel‑General EID 12 BootMode=2, and third‑party security services stopping (System EID 7036)"
- Look out for tooling being added to the Safe Mode minimal‑service registry list
What this means for security teams, affected enterprises, and end users
Security teams should treat Safe Mode boots as a high‑risk operational indicator and add the specific event IDs and msconfig/bcdedit activity Huntress named to detection rules. Affected enterprises and procurement leaders need to prioritize MFA for VPNs and consider IP allow‑listing or disabling SSL VPNs during active attacks, and to ensure EDR coverage on every host. End users should be aware that credential reuse and weak VPN authentication remain common initial access vectors and that rapid credential rotation after a compromise is a repeated recommendation.
This episode is a blunt reminder that adversary tradecraft can both blind defenders and — by accident — fail. The failure in this case gave the victim breathing room, but Huntress warns that neither the memory error nor Safe Mode itself is a dependable safeguard; attackers can change their tools or move to hosts with larger memory footprints. Organizations that follow the practical detections and hardening steps Huntress lays out will be better positioned the next time an affiliate of Akira or another group tries the same play.
https://www.infosecurity-magazine.com/news/akira-affiliate-crashes-ransomware/
