Akira ransomware’s Safe Mode attack disabled defenses

An Akira ransomware affiliate rebooted a victim into Safe Mode to disable Huntress and Microsoft Defender, but the restricted environment also caused Akira’s encryptor to fail. The attackers still stole credentials and data after entering through an MFA-less SonicWall VPN; earlier coverage examined how DeadLock suppresses Windows defenses and complicates recovery in a related ransomware campaign.
Source

👉@sysadminoff

https://4sysops.com/archives/akira-ransomwares-safe-mode-attack-disabled-defenses/