[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMRe_4uGO599QLwX_KeyUOHnF6ELWqxy9-3ezlWOyIWY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":24,"status":25,"created_at":26,"published_at":27,"article":28,"tags":32,"podcasts":51,"controls":58},"3504ee67-7005-478d-9631-14bfda59a24c","akira-ransomware-exploits-unpatched-vpn-and-safe-mode-to-bypass-edr","cc5fa510-d69a-44f6-b105-39d7abdb4c75","Akira Ransomware Exploits Unpatched VPN and Safe Mode to Bypass EDR","An Akira ransomware affiliate gained initial access through an unpatched SonicWall VPN appliance — a critical failure in patch management that left a well-known attack vector wide open. Once inside, the attacker abused Safe Mode with Networking, a legitimate Windows feature, to disable endpoint detection tools like EDR and Microsoft Defender, demonstrating how configuration weaknesses can be weaponized. Although the ransomware payload failed to execute, the attacker still successfully exfiltrated sensitive data for double-extortion purposes, proving that encryption is no longer required for significant business harm. This incident highlights that patching internet-facing appliances and hardening endpoint configurations are non-negotiable baseline controls.","**Immediate actions:**\n- Patch or upgrade all SonicWall VPN appliances (and other internet-facing devices) to the latest vendor-released firmware immediately.\n- Audit and restrict which accounts have the privileges required to reboot systems into Safe Mode.\n- Verify EDR solutions are configured to persist and remain active during Safe Mode boots where technically supported.\n\n**Long-term improvements:**\n- Implement a formal vulnerability management program that prioritizes internet-facing assets with a ≤72-hour SLA for critical CVEs.\n- Enforce network segmentation so that a compromised VPN endpoint cannot directly reach internal RDP services or sensitive data stores.\n- Deploy a privileged access management (PAM) solution to limit lateral movement via RDP and enforce just-in-time access.\n\n**Detection measures:**\n- Alert on unexpected Safe Mode reboots and boot configuration changes (e.g., `bcdedit` commands) via SIEM or endpoint telemetry.\n- Monitor for large outbound data transfers and use Data Loss Prevention (DLP) controls to detect and block exfiltration attempts.\n- Establish baseline RDP usage patterns and trigger alerts on anomalous lateral movement between hosts.",[12,13,14,15,16,17,18,19,20,21,22,23],"CIS Control 7: Continuous Vulnerability Management","CIS Control 4: Secure Configuration of Enterprise Assets","CIS Control 6: Access Control Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-53 SI-2: Flaw Remediation","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 CM-6: Configuration Settings","NIST SP 800-53 SC-7: Boundary Protection","NIST SP 800-53 AU-12: Audit Record Generation","MITRE ATT&CK T1562.001: Impair Defenses — Disable or Modify Tools","MITRE ATT&CK T1021.001: Remote Services — Remote Desktop Protocol","GDPR Article 32: Security of Processing (data exfiltration risk)",{},"published","2026-08-13T22:20:50.232733+00:00","2026-08-13T22:20:49.924+00:00",{"id":7,"url":29,"slug":30,"title":31},"https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fakira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt\u002F","akira-hackers-disable-edr-with-safe-mode-steal-data-but-fail-to-encrypt-dace2b","Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt",[33,39,45],{"id":34,"name":35,"slug":36,"description":37,"color":38},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":40,"name":41,"slug":42,"description":43,"color":44},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",{"id":46,"name":47,"slug":48,"description":49,"color":50},"af7fce9e-1ce8-4156-93bc-09dcfbfdf29d","Patch Management","patch-management","Unpatched vulnerabilities, delayed updates","#ef4444",[52],{"id":53,"date":54,"edition":55,"title":56,"audio_url":57},"3287ed4a-483b-43e1-bbcc-442c76ddae93","2026-08-14","morning","ThreatNoir Morning Brief — August 14","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-14\u002Fthreatnoir-morning-brief-2026-08-14.mp3",[59,63,66],{"slug":60,"name":61,"problem":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",{"slug":48,"name":64,"problem":65},"Automated patch management","Known holes get closed in days, not months.",{"slug":67,"name":68,"problem":69},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped."]