An Akira affiliate rebooted a host into Safe Mode to blind EDR. Defender named the ransomware and could not remove it for 28 minutes

Four hours and twenty-seven minutes, start to finish

Huntress published this incident on 12 August 2026, written up by James Northey with analysis from Dray Agha. The intrusion itself ran on 4 August, and the whole thing took less time than a working morning.

What makes it worth a briefing is not the speed, which is ordinary for Akira now. It is the twenty-nine minutes in the middle where the security stack knew exactly what it was looking at and could not do anything about it.

The Safe Mode play

At 06:29:21 UTC the operator ran msconfig.exe and forced a reboot. The host came back up in Safe Mode with Networking, which the Windows logs record plainly:

Kernel-Boot     EID 27:  LoadOptions = NOEXECUTE=OPTOUT SAFEBOOT:NETWORK
Kernel-General  EID 12:  BootMode = 2

Safe Mode loads core Windows drivers and services and nothing else. Third-party security products are excluded from that minimal set by design, so the Huntress agent did not start. Windows Defender logged its own failure seconds into the boot:

Windows Defender  EID 3002
Error Code: 0x8007043c
"This service cannot be started in Safe Mode"

One reboot, and both the EDR agent and real-time protection were gone, with network connectivity intact. This is T1688, Impair Defences: Safe Mode Boot. Snatch and AvosLocker have used it for years. Huntress reports this as the first time they have observed Akira doing it.

The detail worth pausing on is what the operator did before rebooting. Safe Mode would have killed their own remote access tool too, so they added it to the list of services allowed to start:

reg.exe add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\AnyDesk /ve /d Service

They kept their tooling and dropped yours. That asymmetry is the technique, and it is entirely a matter of which registry keys exist before the reboot.

Detection without remediation

This is the part that should change something in your estate.

Huntress put it in one sentence, and it is the sentence to take to a board: "we had detection without the ability to remediate."

The antivirus was not evaded. It scanned the file, matched it, and named the family and variant precisely. Every part of the detection worked. What did not work was the part nobody buys separately, which is the ability to act on a detection, and that was gone because the host was in a boot mode where the acting component is not permitted to run.

So the payload was removed only after the attacker undid their own trick. For that whole window, the attacker decided when the antivirus was allowed to do its job.

The self-own, and why it is not a defence

The ransomware did not encrypt anything. Safe Mode boots with a stripped-down environment and constrained virtual memory, and the Akira process tree starved in it. Thirteen seconds after the child-process burst, the host began throwing System EID 26, first Virtual Memory Minimum Too Low and then Out of Virtual Memory, followed by PowerShell hard errors about a stack guard page that could not be created.

It is tempting to file that as a win. Huntress does not, and neither should anyone else. Their own caveat is precise: a host with more physical memory or a larger page file might give the encryptor enough room, and the developers can retool it to demand less. The failure was a property of that host on that morning, not of the technique.

A control you did not configure, cannot observe and cannot repeat is not a control. It is a coincidence that happened to break the right way.

The full technique list

Two things stand out reading it as a list rather than a story. There is no exploit anywhere in it. Every step is a legitimate feature used as intended: a VPN login, RDP, two PowerShell cmdlets shipped with Windows, WinRAR, a boot mode Microsoft provides for troubleshooting, and a commercial remote support tool. The only unsigned, obviously malicious artefact in the whole chain is akira.exe, and that is the one thing that failed.

The second is the enumeration. $formatenumerationlimit = -1 removes PowerShell's four-item truncation on multi-valued attributes, so MemberOf comes back complete. That is not a copy-paste artefact. Somebody wanted every group membership of every user, and knew the default would have hidden most of them.

Nothing was encrypted and the victim is still being extorted

The credentials and the file shares left before the encryptor ever ran. Collection and exfiltration finished around 06:20 UTC; the ransomware attempt started at 06:34.

So the outcome here is a victim who did not lose availability and lost everything else. Double extortion means the leak threat stands on its own, and a full Get-ADUser dump with PasswordLastSet, LastLogonDate, email addresses, phone numbers and mailbox locations for every account in the domain is exactly the sort of thing that makes a leak site posting effective.

"We stopped the ransomware" and "we stopped the incident" are different sentences, and only one of them is true here.

What to check this week

The fourth item is the one nobody has. Boot configuration changes are treated as desktop support noise almost everywhere, which is precisely why they are worth an alert on a server.

The position

This is the fifth story in a week with the same shape, and by now the shape is the point.

The Patch Tuesday zero-day was rated Important. Grok Bot's review step exists and is optional. The Lazarus exploit was patched while the recruiter approach that delivered it was not. Passkeys stop phishing and were heard to stop theft. And here, an antivirus detected ransomware by name and could not remove it, because detection and response are two products sold as one word.

Every one of those controls did exactly what its specification says. The gap is between the specification and what people believe they bought, and no patch closes that.

The practical version for this incident is short. Ask your provider what happens to their agent when a host boots into Safe Mode. Not whether they detect Safe Mode boots, which many do. Whether the agent runs. If the answer is no, then a single msconfig.exe and a reboot is a supported, documented Windows feature that turns your endpoint protection off, and your entire response to that is whatever your logging notices in the gap.