Akira ransomware uses Safe Mode to disable EDR, misfires on encryptor
After a credential‑spray into an un‑MFA’d SonicWall SSL VPN, an Akira affiliate RDP’d to the domain controller, stole data, then forced the host into Safe Mode with Networking via msconfig.exe. The reboot disabled Huntress’s agent and Microsoft Defender, but also caused memory errors that halted the encryptor. Incident shows anti‑EDR tricks can backfire and why safe‑mode reboots should trigger alerts.