Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstalliTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
In an incident Huntress reported on August 13, 2026, an Akira affiliate rebooted a victim’s computer into Safe Mode with Networking, where Huntress says its agent and Windows Defender real-time protection were not operating. The attacker retained remote access and had already stolen files and credentials before the ransomware failed to encrypt them. The report documents one case—not evidence that Safe Mode has become a standard Akira tactic.
How the Akira incident unfolded
Huntress’s incident analysis describes an intrusion that began through an exposed SonicWall SSL VPN without multifactor authentication (MFA). The affiliate then accessed a domain controller, enumerated Active Directory, archived file shares and exfiltrated data.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
Security with Keys, Anti-Theft, Screw Styles | $10.49 | Buy on Amazon |
- Initial access: The attacker entered through the exposed VPN, which did not require MFA.
- Discovery and theft: After reaching a domain controller, the attacker enumerated Active Directory, archived file shares and took data and credentials out of the environment.
- Safe Mode preparation: Before deploying the ransomware, the affiliate rebooted the victim host into Safe Mode with Networking and added AnyDesk to the Safe Mode service list to keep remote access available.
- Encryption attempt: Huntress reports that the encryptor encountered virtual-memory errors in the stripped-down environment and failed.
- Detection and quarantine: Defender detected the payload later, but Huntress says successful quarantine came only after the attacker returned the host to normal mode.
Huntress called the behavior “a first for this ransomware variant in our telemetry.” That qualification matters: it describes the firm’s observed case, not the prevalence of the tactic across Akira attacks.
What Safe Mode changed in this case
Safe Mode starts Windows with a reduced set of services and drivers. In Huntress’s account, Safe Mode with Networking provided enough connectivity for the attacker’s remote-access tool while the Huntress agent and Defender real-time protection were not operating. That combination gave the affiliate an opportunity to run the encryptor with less endpoint monitoring in place.
#1 Best Overall
- With strict control and, high factors, can be used with peace of mind
- Works with most desktops, docking stations with built-in security locking slot hole
- Fine workmans ship make sure they are perfect to use
- Protect your computer and its valuable data with this computer
- metal, multi-layer plating color, do not fade, long-life
The report is an account of one investigated incident, not a controlled test of Windows or a guarantee that the same tools will behave identically on every device. The encryption failure was also specific to this host: Huntress attributed it to virtual-memory errors, not to a reliable protection supplied by Safe Mode. Most importantly, the failure happened after the attacker had exfiltrated files and credentials.
How this fits Akira’s known defense evasion
The FBI-led joint advisory, updated November 13, 2025, describes Akira actors disabling antivirus processes and uninstalling endpoint detection and response (EDR) software. It also notes use of PowerTool to exploit the Zemana AntiMalware driver and terminate antivirus processes. That advisory establishes a broader pattern of attempts to weaken security tools; it does not report or independently confirm the Safe Mode incident Huntress described later.
Microsoft characterizes Akira as a ransomware-as-a-service operation that uses double extortion: attackers steal data and then encrypt systems, threatening to publish the stolen information. Microsoft also identifies VPN vulnerabilities, stolen Remote Desktop Protocol (RDP) credentials and phishing among access methods used by Akira actors. In this context, a failed encryption attempt should not be mistaken for a failed intrusion.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What to do if ransomware fails to encrypt files
Treat a suspected ransomware attempt as a security incident even if files appear readable or the encryptor crashed. Theft, credential exposure and persistence may have occurred before encryption began.
Quick Recap
- Coordinate isolation: Follow your incident-response plan to disconnect affected devices from the network and contain the threat. CISA advises coordinated isolation. If you cannot disconnect a device from the network, CISA discusses powering it down as an alternative; shutdown can destroy volatile evidence, so involve qualified incident responders when possible.
- Preserve evidence: Keep ransom notes and encrypted files, as Microsoft advises. Avoid cleanup or reimaging before responders can determine what happened and preserve relevant evidence.
- Assess exposure beyond encryption: Investigate whether data was accessed or exfiltrated, whether credentials were compromised, and whether attackers still have remote access. Do not use the absence of encrypted files as proof that systems are safe.
- Check recovery options: Identify unaffected offline backups and validate the recovery plan before restoring. Microsoft specifically advises checking unaffected offline backups.
- Use expert support: For an organizational incident, involve your security and incident-response teams or a qualified incident-response provider. Decisions about isolation, evidence collection and recovery depend on the environment.
Controls to review before an incident
- VPN access: Require MFA for remote access and monitor for unusual authentication attempts. The reported intrusion began at a VPN without MFA.
- Boot and security-service telemetry: Review whether your monitoring can alert on unexpected boot-configuration changes, transitions into Safe Mode and security-service stops. Huntress identified these as useful signals in light of the incident.
- Endpoint coverage: Check how your endpoint monitoring behaves when a device starts in Safe Mode, and make sure responders know how to investigate a period when expected telemetry disappears. EDR is a useful control category, but the FBI-led advisory shows that attackers may also try to disable or remove security tools.
- Backups and response readiness: Maintain unaffected offline backups and a tested recovery process. Define who can authorize isolation and how the team will preserve evidence while containing an incident.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
