CTI · reviewed · 2026-08-18

One Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion

Full story & timeline

MITRE ATT&CK

• T1110 Brute Force Credential Access
• T1078 Valid Accounts Stealth
• T1688 Safe Mode Boot Defense Impairment
• T1486 Data Encrypted for Impact Impact
• T1562 Impair Defenses Stealth

Indicators

No curated indicators tied to this case.

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: Akira Ransomware Safe Mode Anti-EDR Technique
id: 7b2c3d4e-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects Akira ransomware affiliates rebooting into Safe Mode with Networking to disable EDR and endpoint protection. This technique was first documented in August 2026 intrusions where the attacker installed AnyDesk, added it to Safe Mode registry keys, and forced a reboot to blind security tools.
references:
  - https://cyberpress.org
  - https://gbhackers.com
  - https://bleepingcomputer.com
  - https://socfortress.medium.com
author: Tia N. List
date: 2026-08-18
tags:
  - attack.defense-evasion
  - attack.t1562
  - attack.t1688
logsource:
  category: process_creation
  product: windows
detection:
  selection_bcdedit:
    EventID: 1
    Image|endswith: '\bcdedit.exe'
    CommandLine|contains|all:
      - '/set'
      - safeboot
      - network
  selection_ridisable:
    EventID: 1
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      - 'CurrentControlSet'
      - 'SafeBoot'
      - 'Network'
  condition: selection_bcdedit or selection_ridisable
falsepositives:
  - Legitimate administrative Safe Mode boot for troubleshooting
  - IT helpdesk remote management
level: high

References

• https://cyberpress.org
• https://gbhackers.com
• https://bleepingcomputer.com
• https://socfortress.medium.com