Reported by 5 outlets
One Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion
Why this score
- Breadth
- 2.00 / 2.0 · 5 sources
- Authority
- 1.80 / 2.0 · best outlet weight
- Severity
- 0.80 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.58 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Desk analysis
A Huntress-documented intrusion from early August 2026 shows how one missing control decides the outcome of an Akira ransomware attempt. At 03:45 UTC on August 4, attackers ran a credential spray against a SonicWall SSL VPN from several external IP addresses; at 03:52 one login succeeded on an account with no MFA. Within roughly two hours the operator had connected to the domain controller via RDP, enumerated Active Directory users and computers, and moved to an application server.
The attacker archived mapped file shares with WinRAR and uploaded the data with the s5cmd tool to an attacker-controlled S3 bucket, then installed AnyDesk. To strip protections, the host was forced to reboot into Safe Mode with Networking, which kept the Huntress agent and Microsoft Defender real-time protection from loading for about ten minutes; AnyDesk was added to the Safe Mode registry so it would start after reboot. Huntress notes this is the first documented Akira use of Safe Mode as an anti-EDR tactic.
Encryption ultimately failed: the constrained Safe Mode environment crashed the ransomware process tree with virtual-memory errors seconds after launch, but the data was already exfiltrated, preserving extortion leverage. Watch for further Safe Mode-based EDR evasion by Akira affiliates, and for MFA enforcement on exposed SSL VPN endpoints, which remains the single control that breaks this intrusion chain at step one.
Timeline
-
original reporting
One Missing MFA Control Lets Credential Spray Become Full Akira Ransomware Intrusion
cyberpress.org · 61d ago · August 13th, 2026
A single missing multi-factor authentication (MFA) control turned a basic credential-spraying attempt into a near-complete Akira ransomware intrusion in early August 2026. The incident shows how quickly an exposed VPN can become the starting point for domain-wide reconnaissance, data theft, defence evasion, and ransomware deployment. Akira remains one of the most active ransomware operations, with affiliates repeatedly abusing VPN services that lack MFA. Their common playbook is direct: obtain valid remote-access credentials, move through the Windows domain, steal data, and encrypt systems. Akira operators have also been widely observed using valid VPN accounts, Active Directory discovery, RDP, remote-management tools, and archive utilities during intrusions.sophos+1 Missing MFA Enables Akira The intrusion began at approximately 03:45 UTC on August 4. SonicWall SSL VPN logs recorded failed sign-in attempts against multiple accounts from several external IP addresses. This was a credential spray: attackers try a small set of passwords across many usernames to avoid lockouts and detection. SonicWall log showing the spray (msg 33) resolving into a successful SSL VPN login (msg 1080) (Source: huntress) At 03:52 UTC, one attempt succeeded. The compromised VPN account had no MFA protection, giving the operator immediate remote access without a second verification challenge. Nearly two hours later, the attacker used RDP to access the domain controller. They launched an elevated comm
-
update from gbhackers.com
Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender
gbhackers.com · 61d ago · August 13th, 2026
An Akira ransomware affiliate has been observed rebooting a compromised Windows host into Safe Mode with Networking to disable endpoint protection an anti-EDR tactic linked to the operation. The intrusion failed to encrypt files after the stripped-down boot environment triggered virtual-memory errors, but the actor had already stolen credentials and data, preserving leverage for a […] The post Akira Ransomware Reboots Windows Into Safe Mode to Disable EDR and Microsoft Defender appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .
-
update from bleepingcomputer.com
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
bleepingcomputer.com · 61d ago · August 13th, 2026
The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA). Managed detection and response (MDR) services company Huntress says that roughly two hours after a successful VPN login, the attacker connected to the domain controller via RDP, enumerated Active Directory users and computers, and then moved to an application server. They used WinRAR to archive mapped file shares and the s5cmd command-line tool to upload the stolen data to an attacker-controlled S3 bucket, before installing AnyDesk for remote access. Safe Mode is a Windows startup state designed for troubleshooting and diagnostic operations. It starts Windows with a limited set of drivers and services, generally preventing most third-party software and services from loading. Meanwhile, the attackers added AnyDesk to Windows’ Safe Mode registry, allowing it to start after reboot and retain their remote access to the breached machine. However, when they attempted to
-
update from socfortress.medium.com
Akira Ransomware: Evading EDR via Safe Mode Boot
socfortress.medium.com · 58d ago · August 16th, 2026
Incident Overview and Strategic Context The Akira ransomware intrusion observed in August 2026 represents a calculated effort to exploit the diagnostic limitations of the Windows boot cycle. Traditionally, Akira affiliates have evaded Endpoint Detection and Response (EDR) solutions by deploying clean virtual machines to host their encryptors. However, this incident confirms a strategic evolution toward active environment manipulation. By forcing a reboot into “Safe Mode with Networking,” the threat actor attempted to strip the host of its security telemetry and real-time protections. This tactical shift moves beyond passive avoidance into the aggressive neutralization of the security stack, utilizing a restricted boot environment as a functional blind spot for defenders. Key Takeaways Safe Mode as an Anti-EDR Weapon: For the first time in documented Akira telemetry, affiliates utilized Safe Mode (BootMode = 2) to intentionally disable third-party security agents and Windows Defender. Initial Vector Consistency: The breach originated via an exposed SonicWall SSL VPN appliance lacking Multi-Factor Authentication (MFA), confirming that credential-based entry remains the primary catalyst for Akira campaigns. The “Self-Owning” Paradox: In a significant failure of execution, the constrained memory management of Safe Mode inadvertently sabotaged the attack. The ransomware process tree crashed due to virtual memory exhaustion (EID 26) seconds after launch. Data Exfiltration Success: