Akira strips EDR before it can load: 10 minutes of a blinded Windows host

The number is 10 minutes: the span during which, in Huntress's words, "the host had no working EDR, and AV was blinded" after an Akira ransomware affiliate rebooted a compromised Windows machine into Safe Mode with Networking ^[2]. That reboot took both the Huntress agent and Microsoft Defender's real-time protection offline without the operator ever attacking either product directly ^[3][8].

The mechanism is documented and dull, which is the point. MITRE ATT&CK tracks it as T1688, Impair Defenses: Safe Mode Boot ^[4]. Safe mode starts Windows with a limited set of drivers and services, and third-party security software including EDR may simply not start ^[5]. Hosts can be pushed there on next reboot by editing Boot Configuration Data ^[6]; here the operator used msconfig.exe ^[8]. Adversaries can also add their own software to the minimal service set via the registry ^[7], which is what the affiliate did with AnyDesk so remote access survived the reboot ^[9].

The intrusion around it was conventional. Huntress dates it to August 4, starting with credential spraying against an exposed SonicWall SSL VPN and a successful login about seven minutes in on an account without MFA ^[10]. Roughly two hours later came RDP to the domain controller, Active Directory enumeration, and WinRAR archiving of mapped shares ^[11], with exfiltration to an attacker-controlled S3 bucket via s5cmd ^[12]. Total time from access to stolen credentials and files: under five hours ^[16]. The blind window was about 3 percent of that ^[20], and it came after the data was already gone.

The encryption failed. akira.exe hit virtual memory errors and PowerShell failures in Safe Mode's constrained environment ^[13], and a scheduled Defender scan found the binary but could not quarantine it until the attacker rebooted into normal Windows ^[14]. Huntress warns against reading that as a control: more memory, a larger page file, or a modified encryptor could make it work ^[15].

Watch whether Akira ships an encryptor that tolerates Safe Mode. Huntress says this is its first Akira sighting of the technique, though Snatch and AvosLocker have used it for years ^[17], and an Akira affiliate earlier this year built a fresh VM on a victim hypervisor to run the encryptor outside EDR coverage ^[18]. Detection guidance is pre-reboot: MFA on every VPN account, correlation of failed-login bursts with the successful one, EDR everywhere, and alerts on msconfig.exe, boot configuration edits, Safe Mode boot events, and Safe Boot registry additions ^[19].