The Attack: Credential Stuffing, Data Theft, and a Self-Defeating Encryptor
In early August 2026, an Akira ransomware affiliate compromised a victim organization through a SonicWall SSL VPN account that wasn’t protected by multi-factor authentication. After seven minutes of failed credential spraying, one valid username-password pair worked.
Once inside, the attacker moved to the domain controller via RDP and dumped Active Directory — users, groups, computers, the full property set. They pivoted to an application server, installed WinRAR, and began archiving mapped file shares. The archives were exfiltrated to cloud storage using s5cmd, a fast S3 transfer utility.
They installed AnyDesk configured to start with Windows, using it as both a remote access trojan and a command-and-control channel to drop akira.exe — the ransomware payload.
Three hours into the intrusion, the attacker forced a reboot into Safe Mode with Networking to disable endpoint detection tools and Microsoft Defender. Safe Mode worked as intended: it killed the Huntress agent and disabled real-time protection.
But Safe Mode also broke the ransomware. Akira’s encryptor relies on concurrent worker threads and heavy memory mapping for speed. Safe Mode’s minimal driver set and constrained virtual memory caused the encryptor to fail with memory errors thirteen seconds after reboot.
The victim got lucky. But the data was already stolen.
Why the Upstream Intervention Matters
The article’s security recommendation focuses on detecting Safe Mode boot configuration changes — watching for bcdedit activity, Kernel-Boot event ID 27, and services stopping. That’s useful for incident response, but it’s downstream. By the time Safe Mode is invoked, the payload is already on disk, the data is already archived, and the exfiltration is already complete.
Every phase of this attack required Windows file system operations:
- Payload delivery: akira.exe had to be written to disk via the AnyDesk C2 channel before it could execute
- Data staging: WinRAR had to read files from mapped shares and write archive files to prepare them for exfiltration
- Exfiltration: s5cmd had to read the archive files to upload them to cloud storage
- Encryption (attempted): the ransomware would have written encrypted file contents and renamed original files
A kernel-level file system filter intercepts these operations before they complete. You define what’s allowed. Everything else is blocked.
The FileSure Rule Configuration That Applies
Block unauthorized executable writes from remote access tools:
- Program name filter:
AnyDesk.exe(or*to apply globally and use an authorized-program whitelist) - File name filter:
*.exe, *.dll, *.bat, *.ps1, *.vbs - Operations: Write, Create
- Drive type: Hard drives
- Action: Block and log
Result: When AnyDesk attempts to write akira.exe to disk, the write operation is intercepted and denied. The payload never lands. The ransomware never executes. The encryption phase never starts.
Block unauthorized archive creation from sensitive file shares:
- Program name filter:
WinRAR.exe, 7z.exe, tar.exe(or any archiving tool not explicitly authorized) - File name filter:
*(all files in the target directory) - Path filter:
\\fileserver\shares\*(the mapped file share path) - Operations: Read
- Threshold: 50 file reads within 10 minutes
- Action: Block and alert
Result: WinRAR can open a few files normally. When it begins bulk-reading files to create an archive — crossing the threshold within seconds — subsequent read operations are blocked. The data staging phase is stopped before exfiltration begins.
Detect and block bulk file operations during exfiltration:
- Program name filter:
s5cmd.exe(or*for any unauthorized program) - File name filter:
*.rar, *.zip, *.7z - Operations: Read
- Drive type: Hard drives
- Threshold: 10 matches within 5 minutes
- Action: Block and alert
Result: Cloud upload utilities attempting to read staged archive files trigger the threshold immediately. The exfiltration is blocked before data leaves the network.
The Safe Mode trick didn’t save this victim — they still lost data. Blocking the payload write when it landed would have stopped the entire attack chain at the first file operation.
Try FileSure Defend Free for 21 Days
FileSure Defend enforces file access policies at the Windows kernel level. It blocks unauthorized file operations before they complete — stopping ransomware payloads, data exfiltration, and insider threats without relying on signatures or threat recognition.
Install it on a test system, run our ransomware simulation tool, and watch the write operation get blocked in real time. Then open a Word document and see the access get logged. That’s the whole demo. It works exactly like that, every time.
Start your free trial at bystorm.com — no credit card required.
Source: Akira ransomware scum blocked victim’s security tools – and broke their own encryptor
Category: Ransomware
Tags: akira ransomware, safe mode abuse, data exfiltration, kernel filter driver, file system security, sonicwall vpn, anydesk c2, winrar staging
