In an incident reported by Huntress on August 13, 2026, an Akira affiliate rebooted a victim’s computer into Safe Mode with Networking, where Huntress says its agent and Windows Defender real-time protection were not operating. The ransomware later failed to encrypt files after memory errors, but credentials and data had already been taken. This is a documented incident, not evidence that Safe Mode has become a standard Akira tactic.
What happened in the reported Akira Safe Mode incident?
Huntress’s August 2026 incident analysis describes an intrusion that began with an exposed SonicWall SSL VPN that did not require multifactor authentication (MFA). The attacker reached a domain controller, enumerated Active Directory, collected files from shared storage into archives, and exfiltrated data before deploying the ransomware.
As an Amazon Associate I earn from qualifying purchases.
Before attempting encryption, the affiliate rebooted the victim host into Safe Mode with Networking and added AnyDesk to the Safe Mode service list to retain remote access. Huntress reports that its agent and Windows Defender real-time protection did not operate during that Safe Mode period. Its account is based on this incident, not a controlled test of every Windows configuration or security product.
- The attacker accessed the network through the exposed VPN without MFA.
- They reached a domain controller, enumerated Active Directory, and archived and exfiltrated files.
- They rebooted the host into Safe Mode with Networking and configured AnyDesk to run there.
- The encryptor encountered virtual-memory errors and failed in that environment.
- After the attacker returned the host to normal mode, Defender detected the payload; Huntress says successful quarantine occurred then.
Huntress called this “a first for this ransomware variant in our telemetry.” That wording describes the provider’s own observations; it does not establish how often Akira affiliates use this method across all incidents.
#1 Best Overall
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Why use Safe Mode with Networking?
Safe Mode starts Windows with a reduced set of drivers and services. The networking variant retains network connectivity, which can give a remote attacker a way to control a host while some security components are unavailable. In the Huntress incident, AnyDesk was configured for that purpose, while Huntress observed its own agent and Defender real-time protection offline.
This is not a claim that Safe Mode disables every security product, or that every system will behave the same way. The incident report does not establish a universal Windows setting or product behavior. It does show why a change in boot mode, especially one followed by unexpected remote-access activity, deserves investigation rather than being treated as routine maintenance.
Rank #2
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Does Akira commonly disable security tools?
Akira’s broader defense-evasion history is documented separately from the Safe Mode incident. A joint advisory from the FBI, CISA, DC3, HHS, and international partners, updated November 13, 2025, says Akira actors have disabled security software. It describes use of PowerTool to exploit the Zemana AntiMalware driver and terminate antivirus processes, and reports that actors have also uninstalled EDR systems. That advisory provides context for Akira’s established tactics; it does not corroborate the later Safe Mode case.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Microsoft describes Akira as a ransomware-as-a-service operation using double extortion: stealing data before encrypting systems and threatening to publish the stolen information. It lists VPN vulnerabilities, stolen RDP credentials, and phishing among access methods. The Safe Mode report fits the broader pattern of attempts to evade defenses, but the available reporting does not show that this particular technique is prevalent.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
What does a failed encryption attempt mean?
It does not mean the incident is harmless or contained. In the Huntress case, encryption failed after virtual-memory errors, but file collection and credential theft had already occurred. The report does not establish whether another host or configuration would produce the same failure.
For incident assessment, treat suspicious access and data movement as material even if files remain readable or the encryptor appears to stop. Investigators should establish what systems and credentials were exposed and whether data left the environment; the absence of encrypted files alone cannot answer those questions.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
What should defenders monitor for?
Huntress identifies boot-configuration changes, Safe Mode boot events, and security-service stops as useful signals to monitor. Taken together, these can help surface a transition into a reduced-protection state, particularly when it is unexpected or coincides with remote-access activity.
- Boot changes: Alert on unexpected changes to boot configuration and investigate Safe Mode transitions outside authorized maintenance.
- Security-service interruptions: Review stops or failures involving endpoint protection, including whether protection returns after a reboot.
- Remote access: Correlate new or unusual remote-access activity with boot changes and security-service events.
- VPN access: Require MFA for VPN authentication and monitor for unusual access attempts. The incident began at a VPN without MFA.
- Recovery readiness: Maintain unaffected offline backups and a response process that protects evidence as well as supports recovery.
The FBI-led advisory supports MFA and EDR as part of broader defenses, while CISA guidance emphasizes coordinated incident response. No single monitoring alert or security tool should be treated as proof that an intrusion was prevented or contained.
What should an organization do if it suspects an Akira infection?
Microsoft’s Akira guidance recommends isolating infected devices from the network, preserving the ransom note and encrypted files, and checking unaffected offline backups. CISA’s general ransomware guidance adds an important evidence-preservation consideration: coordinate isolation, and avoid powering down a device when another way to disconnect it is available, because shutdown can destroy volatile evidence. CISA discusses powering down when network disconnection is not possible.
- Coordinate containment. Involve the organization’s incident-response lead or qualified responders and isolate affected devices from the network where feasible. Follow the response plan so containment does not inadvertently erase evidence or disrupt necessary investigation.
- Preserve evidence. Keep ransom notes and encrypted files, and avoid unnecessary changes to affected systems. Record what was observed and when.
- Assess exposure. Investigate access paths, affected accounts and systems, and whether data was collected or exfiltrated. A failed encryption stage does not rule out theft.
- Evaluate recovery sources. Check that offline backups are unaffected before using them, and coordinate restoration with the incident-response effort.
Microsoft’s recommendations are specific to its Akira threat guidance; CISA’s advice is general ransomware guidance. For a live organizational incident, responders should make isolation and evidence-handling decisions in context.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
