AKIRA ransomware affiliates tried to encrypt a victim’s network after breaking in through a SonicWall SSL VPN that lacked multi‑factor authentication, but the attack stalled when the ransomware ran out of virtual memory in Safe Mode.
The intruders first sprayed credentials against the VPN gateway, gained a foothold, then enumerated the internal Active Directory to locate high‑value targets, as detailed in a SecurityAffairs report.
To evade endpoint detection they initiated a reboot into Safe Mode with Networking, a Windows start option that disables many third‑party security drivers while keeping networking active.
When the Akira payload launched, the limited memory environment of Safe Mode triggered an “out of virtual memory” error, halting the encryption routine before any files were locked, according to Infosecurity Magazine.
Nevertheless, the attackers had already exfiltrated a volume of sensitive data, allowing them to pursue a double‑extortion scheme despite the ransomware’s failure.
Huntress observed the activity between 13 August and 17 August 2026 and attributed the campaign to the threat cluster tracked as Storm‑1567.
The attempt shows a growing trend among ransomware operators to abuse safe mode boots as a way to silence behavioural monitors, although the tactic can backfire when the constrained environment prevents the malware from completing its payload.
Organisations should enforce multi‑factor authentication on every VPN portal and monitor authentication logs for abnormal spikes that could indicate credential spraying.
Security teams need to alert on unexpected reboots, especially those that boot into safe mode, and to collect memory‑usage telemetry that can catch ransomware attempting to allocate large buffers.
Endpoint solutions should be configured to run critical protections in a mode that survives safe mode, or to rely on kernel‑level drivers that remain active regardless of user‑space restrictions.
Limiting VPN access to the smallest set of required accounts and enforcing strict least‑privilege policies reduces the payoff of a compromised credential.
Network segmentation between the VPN zone and critical servers limits lateral movement, while disabling the ability to boot into safe mode via BIOS/UEFI passwords removes a common evasion route.
Regular tabletop exercises that simulate a ransomware stall in safe mode help responders practise containment and recovery when encryption fails but data theft has occurred.