Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate gained initial access through an unpatched SonicWall VPN appliance — a critical failure in patch management that left a well-known attack vector wide open. Once inside, the attacker abused Safe Mode with Networking, a legitimate Windows feature, to disable endpoint detection tools like EDR and Microsoft Defender, demonstrating how configuration weaknesses can be weaponized. Although the ransomware payload failed to execute, the attacker still successfully exfiltrated sensitive data for double-extortion purposes, proving that encryption is no longer required for significant business harm. This incident highlights that patching internet-facing appliances and hardening endpoint configurations are non-negotiable baseline controls.