The recent discovery of a unique ransomware attack strategy by Huntress highlights the evolving tactics employed by cybercriminals. In this case, an Akira affiliate attempted to evade security measures by rebooting a victim's system into Safe Mode, only to inadvertently crash the ransomware itself. This incident underscores the importance of understanding the intricate relationship between security tools and malware evasion techniques.
The attack began with a credential spraying attack, granting the attacker initial access to a SonicWall SSL VPN without multifactor authentication (MFA). This is a common entry point for many cybercriminals, emphasizing the need for robust MFA implementation across all systems. Once inside, the attacker used Remote Desktop Protocol (RDP) to access the domain controller and initiate Active Directory (AD) enumeration, a familiar step in the Akira playbook.
The attacker then proceeded to collect files from the application server and transfer them to cloud storage using s5cmd, a fast S3 transfer utility. This data exfiltration step is a hallmark of double extortion attacks, where cybercriminals steal data before encrypting it, threatening to release it if the ransom is not paid. However, the attack took an unexpected turn when the threat actor attempted to evade detection by rebooting the system into Safe Mode.
Safe Mode, designed to provide a minimal operating environment, effectively blinds third-party security services, including the Huntress agent and antivirus software. This approach is not new, as MITRE ATT&CK lists it as 'Impair Defences: Safe Mode Boot'. While this tactic can temporarily disable security controls, it also inadvertently triggers host memory errors, preventing the ransomware from executing its encryption process.
The author of the Huntress report suggests that this outcome is a double-edged sword. While the attacker's attempt to evade detection backfired, it also highlights the importance of monitoring and defending against such tactics. The report emphasizes the need for organizations to implement robust security measures, such as blocking credential spray attacks, deploying MFA, and using EDR on every host.
Furthermore, the report advises organizations to look out for specific indicators of the 'Safe Mode play', including changes in boot configuration and the behavior of third-party security services. By staying vigilant and adapting their security strategies, organizations can better protect themselves against evolving ransomware threats.
