Akira Ransomware Bypasses EDR via Safe Mode after MFA‑less SonicWall VPN Compromise
What Happened — An Akira ransomware affiliate gained initial access through an MFA‑less SonicWall VPN on August 4, 2026. After harvesting credentials and file shares, the attacker rebooted the compromised host into Safe Mode with Networking, which disabled the installed EDR and Windows Defender real‑time protection, then launched the ransomware payload. The encryptor failed due to memory constraints in Safe Mode, but the exfiltrated data remained in the attacker‑controlled S3 bucket, leaving the victim vulnerable to extortion.
Why It Matters for Compliance & Audit Readiness
- Demonstrates how weak VPN authentication (no MFA) violates SOC 2 CC6.1 logical‑access and CC6.2 authentication controls.
- Shows the need for continuous endpoint‑monitoring evidence (SOC 2 CC7.1) that can survive atypical OS states such as Safe Mode.
- Highlights the importance of documented incident‑response playbooks (SOC 2 CC7.2) that include detection of EDR disablement and rapid remediation.
Who Is Affected – Any organization that relies on VPN remote‑access solutions without MFA, especially those in technology, professional services, and finance sectors.
Recommended Actions
- Enforce MFA on all VPN gateways and regularly audit VPN configurations.
- Validate that EDR solutions retain protective capabilities (or at least generate alerts) when a system boots into Safe Mode.
- Update incident‑response procedures to include detection of Safe‑Mode reboots and rapid restoration of real‑time protection.
Source: Security Affairs – Akira Ransomware Uses Safe Mode to Bypass EDR
Technical Notes – Attack vector: credential‑spray on an exposed SonicWall VPN (no MFA). Post‑compromise actions: registry modification to persist AnyDesk, Safe Mode boot to kill EDR, ransomware execution (memory‑starvation failure). Data types exfiltrated: file shares, Active Directory enumeration. No specific CVE cited.