Akira ransomware scum blocked victim's security tools – and broke their own encryptor

In early August, Huntress detected an Akira ransomware attack that began with a SonicWall SSL VPN. The intrusion started with a credential-spray attack, where the attacker made numerous failed login attempts using bad credentials. However, one of those attempts succeeded when the attacker used a valid VPN account that was not protected by multi-factor authentication (MFA).

Once inside, the attacker gained access to the domain controller via Remote Desktop Protocol (RDP) and queried Active Directory to gather detailed information about the network, users, groups, and computers. Akira ransomware affiliate then proceeded to collect stolen data from file shares, archive it using WinRAR, and transfer it to cloud storage using s5cmd.

They also installed remote desktop software AnyDesk, using it as a remote-access trojan and command-and-control channel for additional malware, including Akira ransomware binary, akira.exe.

About three hours into the intrusion, the attacker rebooted the computer into Safe Mode with Networking, a boot mode that only loads essential drivers and services, effectively blocking most third-party software. This move aimed to disable endpoint detection and response (EDR) products and other security tools that would otherwise detect and stop the ransomware.

While Safe Mode has been extensively used by other ransomware gangs, Akira had not been observed employing this technique until now. Unfortunately, this strategy backfired for the attacker. Upon reboot, the computer started emitting memory errors due to the limited memory capacity in Safe Mode. As a result, Akira's encryptor was unable to encrypt the endpoint, rendering the attack ineffective.

The security team at Huntress recommended implementing multi-factor authentication (MFA) for all VPN accounts and monitoring for Safe Mode boot configuration changes and Safe Mode boots.