An **Akira** ransomware affiliate recently demonstrated a sophisticated evasion technique, disabling the endpoint detection and response (EDR) solution on a compromised system by forcing a reboot into Safe Mode with Networking. The attack, which occurred on August 4, began with initial access gained through an exposed **SonicWall VPN** device lacking multi-factor authentication (MFA).  **Huntress**, a managed detection and response (MDR) services company, reported that approximately two hours after a successful VPN login, the attacker connected to the domain controller via RDP. They then enumerated **Active Directory** users and computers before moving to an application server. The attackers utilized **WinRAR** to archive mapped file shares and the `s5cmd` command-line tool to upload the stolen data to an attacker-controlled S3 bucket. Following this, **AnyDesk** was installed for persistent remote access. It was at this stage that the attacker used **AnyDesk** to force the compromised host to boot into Safe Mode with Networking, effectively disabling both the **Huntress** agent and **Microsoft Defender**’s real-time protection. Safe Mode is a Windows startup state designed for troubleshooting, loading only a limited set of drivers and services. This typically prevents most third-party software and services from loading. For a critical 10-minute window while in Safe Mode, "the host had no working EDR, and AV was blinded," **Huntress** stated in their analysis. During this period, the attackers added **AnyDesk** to Windows’ Safe Mode registry, ensuring continued remote access after the reboot. However, their attempt to launch the main ransomware payload (`akira.exe`) via **AnyDesk** in Safe Mode failed. The system reported low virtual memory and generated out-of-memory and **PowerShell** errors.  A scheduled **Defender** scan eventually detected the **Akira** executable, despite real-time protection being disabled in Safe Mode. However, the security tool could not remove it while the machine remained in that mode. **Defender** only quarantined the file after the attacker rebooted the system into normal mode, which restored real-time protection. Despite the failure to encrypt files, the **Akira** operator successfully exfiltrated credentials and files for data extortion, all within less than five hours from initial access. **Huntress** noted that while other ransomware families like **Snatch** and **AvosLocker** have employed this tactic for years, this incident marks the first observed use by an **Akira** affiliate. Researchers recommend implementing MFA for all VPN accounts, deploying credential-spraying detection measures, and continuously monitoring for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry.