Akira Disables EDR via Safe Mode Reboot, Steals Data
An Akira ransomware affiliate rebooted a compromised host into Safe Mode to kill EDR, exfiltrated data, then failed to encrypt. The exfiltration is the real threat.
airgap Confirmed incident. An Akira ransomware affiliate rebooted a compromised Windows host into Safe Mode with Networking, disabled the endpoint detection and response (EDR) solution, exfiltrated data, then failed to complete encryption. BleepingComputer, August 13, 2026.
The EDR Kill Mechanism
Safe Mode with Networking loads a minimal driver set. Most EDR agents register as standard Windows services — they don’t load in Safe Mode. The result is a functioning OS with C2 connectivity and no behavioral monitoring. No kernel exploit, no process injection, no admin-level driver termination required. Attacker forces a reboot; EDR disappears.
Networking is explicitly preserved. Exfiltration channels stay open.
Confidence: Technique is consistent with documented Safe Mode EDR bypass behavior — CrowdStrike, SentinelOne, and others flagged this class of bypass in prior public disclosures. Attribution of the technique to this specific Akira incident: single source, BleepingComputer. Not independently confirmed as of this writing.
The Encryption Failure
Akira’s payload failed to execute cleanly in Safe Mode. Precise cause: unconfirmed. BleepingComputer reporting does not identify a specific failure reason.
Analysis — labeled as assessment:
Some ransomware families are purpose-built for Safe Mode execution — REvil hardened its encryptor for this environment explicitly. Akira’s payload may not have been. Alternatively, partial detection or manual defender intervention interrupted the encryption stage after the reboot anomaly was caught. Either is plausible; both are unconfirmed.
Why the Failure Doesn’t Matter
Data was exfiltrated before encryption was attempted. The double-extortion model does not require encryption — it requires leverage. In 2026, the stolen data is the leverage. “We failed to encrypt” is operationally meaningless if the exfiltration succeeded.
Defensive Notes
- Alert on unscheduled Safe Mode configuration.
bcdedit /set safebootexecution, registry writes toHKLM\SYSTEM\CurrentControlSet\Control\SafeBoot, or equivalent WMI calls from non-approved processes should trigger immediate investigation — not just a log entry. - The real detection window is before the reboot. Safe Mode access requires the attacker to already have local admin or SYSTEM. Initial access and privilege escalation are where this attack is most interruptible.
- Post-Safe-Mode audit. An unexplained Safe Mode reboot is a confirmed exfiltration indicator until proven otherwise. Treat it as one.
- Network egress during Safe Mode. Safe Mode with Networking is not a network blackout. Anomalous outbound connections from a host during a Safe Mode window are meaningful signals.
Akira is an active ransomware operation. Related: Deadlock Ransomware Moves Ransom Funds via Polygon · Ransomware topic hub
Found this useful? Share it.
