THE article discusses an Akira ransomware attack that utilized Safe Mode to circumvent Endpoint Detection and Response (EDR) systems. The attackers accessed a company's system via a Multi-Factor Authentication (MFA)-less SonicWall VPN, disabled security tools by rebooting into Safe Mode with Networking, and attempted to launch the ransomware. However, memory limitations in Safe Mode led to the encryption process failing due to an 'out of virtual memory' error.
Key points include:
1. Successful credential compromise via SonicWall VPN without MFA.
2. The attacker rebooting into Safe Mode to disable EDR tools before launching the ransomware.
3. Exfiltration of data occurred before the failed encryption attempt, allowing for extortion despite the ransomware not executing.
4. Recommendations for detection include monitoring specific system events and registry alerts related to changes in Safe Mode.
The incident highlights vulnerabilities in ransomware attacks and the potential for future successful encryption if attackers adjust their methods.