MalwareBleeping Computer
6.8 — HIGH
Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]
🤖 AI BriefingAuto-generated threat analysis
🔍Threat Overview
Akira ransomware attackers successfully compromised a system through an exposed SonicWall VPN device, disabling EDR and stealing data before failing to encrypt files due to Safe Mode limitations.
⚙️Technical Details
Affected Systems
SonicWall VPN devices
Attack Vectors
Exposed VPN devices without multi-factor authentication (MFA), RDP connection to domain controller
💥Impact Assessment
Severity: high
Who Is at Risk
Organizations with exposed SonicWall VPN devices and users of those devices
🛡️Recommended Actions
1Add MFA to all VPN accounts
2Place credential-spraying detection measures
3Monitor for Safe Mode boot configuration changes or remote-access tools being added to the Safe Mode service registry
📦Affected Products
Software: SonicWall VPN devices, Windows operating system
Read the full article
This is a curated summary. The complete article is available at Bleeping Computer.