Akira Ransomware: Neutralizing Microsoft Defender and Huntress via BCDEDIT and Safe Mode
Akira ransomware affiliates are deploying a sophisticated evasion tactic by forcing compromised Windows environments into Safe Mode with Networking. By leveraging bcdedit and msconfig.exe to modify boot configurations, attackers effectively neutralize endpoint security agents—including Microsoft Defender and Huntress—that fail to initialize in the minimal Safe Mode startup environment. This technique follows initial access via credential spraying against MFA-deficient VPNs, such as SonicWall, and subsequent RDP-based lateral movement. While the Safe Mode transition successfully blinds security telemetry and facilitates data exfiltration via s5cmd to AWS S3, the akira.exe payload has encountered stability issues, including "Out of Virtual Memory" errors, which can occasionally impede the final encryption phase.