Akira Ransomware: Neutralizing Microsoft Defender and Huntress via BCDEDIT and Safe Mode

Akira ransomware affiliates are deploying a sophisticated evasion tactic by forcing compromised Windows environments into Safe Mode with Networking. By leveraging bcdedit and msconfig.exe to modify boot configurations, attackers effectively neutralize endpoint security agents—including Microsoft Defender and Huntress—that fail to initialize in the minimal Safe Mode startup environment. This technique follows initial access via credential spraying against MFA-deficient VPNs, such as SonicWall, and subsequent RDP-based lateral movement. While the Safe Mode transition successfully blinds security telemetry and facilitates data exfiltration via s5cmd to AWS S3, the akira.exe payload has encountered stability issues, including "Out of Virtual Memory" errors, which can occasionally impede the final encryption phase.

• Attack Vector and Initial Access

  • Affiliates target MFA-deficient VPN concentrators, specifically SonicWall appliances, through credential spraying.
  • Successful authentication leads to lateral movement within the network using Remote Desktop Protocol (RDP).
  • Data exfiltration is performed by archiving file shares with WinRAR and utilizing s5cmd to move data to attacker-controlled Amazon S3 buckets.

• Evasion Mechanics: Impairing Defenses

  • Attackers utilize bcdedit and msconfig.exe to manipulate Windows Boot Configuration Data (BCD), forcing the system into Safe Mode.
  • The strategy exploits the fact that many EDR/XDR agents do not load kernel-level drivers or essential services in a minimal boot environment (MITRE ATT&CK T1688).
  • Safe Boot registry keys are modified to ensure persistence for remote access tools like AnyDesk, allowing continued control during the evasion phase.

• Technical Impact and Execution Stability

  • The primary impact is the total loss of real-time protection and endpoint visibility during the Safe Mode session.
  • The akira.exe ransomware binary has demonstrated significant operational instability within Safe Mode due to strict virtual memory limitations.
  • Observed errors include "Virtual Memory Minimum Too Low" and "Out of Virtual Memory," which can prevent successful file encryption.

• Detection and Mitigation Strategies

  • Enforce mandatory Multi-Factor Authentication (MFA) on all VPN and RDP entry points to prevent initial access.
  • Implement monitoring for unauthorized modifications to BCD settings or suspicious execution of bcdedit.exe and msconfig.exe.
  • Monitor for anomalous outbound data transfers to cloud storage providers, particularly via command-line utilities like s5cmd.
  • Review EDR/XDR configurations to verify agent behavior and visibility during minimal boot or Safe Mode scenarios.