[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fqM7UxCu6g5HcwVFqE-hRLDbD748DHsb3FGR91a7P-9s":3},{"article":4,"iocs":56,"watch_terms":63,"solutions":64,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":33,"category":34,"article_tags":38},"cc5fa510-d69a-44f6-b105-39d7abdb4c75","Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt","akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-dace2b","An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. [...]","An Akira ransomware affiliate exploited an unpatched SonicWall VPN to gain initial access, then used RDP to move laterally and steal data. The attacker disabled EDR and Microsoft Defender by rebooting the compromised system into Safe Mode with Networking. While the ransomware payload failed to execute due to memory issues, the attacker successfully exfiltrated data for extortion.","Akira ransomware affiliate disables EDR via Safe Mode, steals data but fails to encrypt.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fakira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F02\u002F12\u002Fransomware-3.jpg","2026-08-13T20:47:02+00:00","2026-08-13T22:00:04.554325+00:00",8,[17,20,23,26,29,31],{"name":18,"type":19},"Akira","threat_actor",{"name":21,"type":22},"Huntress","vendor",{"name":24,"type":25},"Microsoft Defender","product",{"name":27,"type":28},"Safe Mode with Networking","technology",{"name":30,"type":25},"SonicWall VPN",{"name":32,"type":28},"EDR","7d8b5ab8-ea0b-4ced-ae97-ec251b86993a",{"id":33,"icon":35,"name":36,"slug":37},null,"Ransomware","ransomware",[39,41,46,51],{"category":40},{"id":33,"icon":35,"name":36,"slug":37},{"category":42},{"id":43,"icon":35,"name":44,"slug":45},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":47},{"id":48,"icon":35,"name":49,"slug":50},"c5eccf7c-abbc-4bd3-bbed-e6da5cba8e73","Incident Response","incident-response",{"category":52},{"id":53,"icon":35,"name":54,"slug":55},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[57,60],{"type":45,"value":58,"context":59},"akira.exe","Akira ransomware executable",{"type":45,"value":61,"context":62},"AnyDesk","Remote access tool used by the attacker",[21,24,30],{"controls":65,"vendors":149},[66,95,120],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":96,"name":97,"problem":98,"products":99},"patch-management","Automated patch management","Known holes get closed in days, not months.",[100,107,112],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":96,"product_name":104,"url":105,"description":106},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":108,"product_name":109,"url":110,"description":111},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":121,"name":122,"problem":123,"products":124},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[125,133,141],{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",[150,155],{"slug":151,"name":21,"logo_path":152,"roles":153},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[154],"reported_by",{"slug":156,"name":157,"logo_path":158,"roles":159},"sonicwall","SonicWall","\u002Fvendor-logos\u002Fsonicwall.png",[160],"affected",{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":178},"akira-ransomware-exploits-unpatched-vpn-and-safe-mode-to-bypass-edr","Akira Ransomware Exploits Unpatched VPN and Safe Mode to Bypass EDR","An Akira ransomware affiliate gained initial access through an unpatched SonicWall VPN appliance — a critical failure in patch management that left a well-known attack vector wide open. Once inside, the attacker abused Safe Mode with Networking, a legitimate Windows feature, to disable endpoint detection tools like EDR and Microsoft Defender, demonstrating how configuration weaknesses can be weaponized. Although the ransomware payload failed to execute, the attacker still successfully exfiltrated sensitive data for double-extortion purposes, proving that encryption is no longer required for significant business harm. This incident highlights that patching internet-facing appliances and hardening endpoint configurations are non-negotiable baseline controls.",[166,167,168,169,170,171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","MITRE ATT&CK T1562.001: Impair Defenses — Disable or Modify Tools","MITRE ATT&CK T1021.001: Remote Services — Remote Desktop Protocol","GDPR Article 32: Security of Processing (data exfiltration risk)",{}]