Akira Ransomware Affiliate Rebooted Into Safe Mode to Dodge EDR and Broke Its Own Attack

An affiliate of the Akira ransomware operation attempted a novel technique to blind endpoint defences during a recent intrusion, rebooting a compromised server into Windows Safe Mode to knock out both an EDR agent and Microsoft Defender in one move, only for the same stripped-down environment to cause the ransomware payload itself to crash before it could encrypt any files.

The incident, disclosed in a technical write-up published by managed detection and response provider Huntress, marks the first time researchers have observed Akira affiliates using a Safe Mode reboot to sidestep security tooling, a tactic more commonly associated with older ransomware families such as Snatch and AvosLocker.