Akira Ransomware Uses Windows Safe Mode to Shut Down EDR Before Launching Encryptor
Akira’s latest tactics expand the ransomware playbook: instead of relying solely on kernel drivers or signed binaries to disable protections, an affiliate in a recent intrusion rebooted a compromised host into Safe Mode with Networking to silence endpoint defenses while keeping network access for remote control and exfiltration. The operation began with a successful credential-spraying attack against an exposed SonicWall SSL VPN that lacked MFA, and it unfolded rapidly—domain enumeration,…