The recent discovery of a ransomware affiliate's attempt to evade security measures by rebooting a victim's system into Safe Mode has revealed an unexpected outcome. This tactic, while intended to bypass security tools, inadvertently prevented the malware from encrypting the target's files, according to research by Huntress. The affiliate, known as Akira, employed a series of steps to gain initial access and move laterally within the network. They used a credential spraying attack to breach a SonicWall SSL VPN without multifactor authentication (MFA) and then accessed the domain controller via Remote Desktop Protocol (RDP). The attacker's goal was to steal files and use them for double extortion, threatening to post them online if the ransom was not paid. However, the critical error came when the threat actor attempted to deploy the ransomware payload.
In a deviation from typical Akira tactics, the attacker ran msconfig.exe and forced a reboot into "Safe Mode with Networking." This action had a significant impact on the security landscape. In Safe Mode, third-party services, including security tools like Huntress, do not start, and Defender real-time protection is disabled. This left the host vulnerable, as the EDR and AV were effectively blinded during the Safe Mode period. The attacker's intention to evade detection backfired, as the Safe Mode environment triggered host memory errors, preventing the ransomware from executing successfully.
This incident highlights the importance of understanding the intricacies of security measures and the potential unintended consequences of evasive tactics. While the attacker's attempt to bypass security controls succeeded in the short term, it may have inadvertently prevented the encryption process. This outcome serves as a reminder that security professionals must stay vigilant and adapt their strategies to counter evolving threats. Organizations should take note of the lessons learned from this incident and implement measures to protect against similar attacks. By blocking credential spray attacks, deploying MFA, and monitoring for specific boot configuration changes, they can enhance their defenses and reduce the risk of successful ransomware intrusions.
