Ransomware Gang Crashes Own Attack — with No-One to Blame but Themselves

Ransomware gang crashes own attack — with no-one to blame but themselves

Akira ransomware tried Safe Mode boot to disable defenses but broke its own encryptorDefender later flagged and quarantined payload, leaving attackers with only stolen dataHuntress advises VPN brute‑force alerts, MFA, SIEM logging, and Safe Mode monitoringA recent ransomware attack saw the operators Akira (figuratively) shoot themselves in the foot - and they still walked away with sensitive data, albeit limping.Akira is a well-known ransomware …

Akira hackers disable EDR with Safe Mode, steal data but fail to encrypt

An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking. The attack occurred on August 4 after the hacker obtained initial access through an exposed SonicWall VPN device without multi-factor authentication (MFA). Managed detection and response (MDR) services company Huntress says that roughly two hours after a successful VPN login, …

Akira Affiliate Crashes Ransomware After Attempting EDR Evasion

Huntress documents how a ransomware affiliate sabotaged its own attack with an anti-EDR effort This article has been indexed from www.infosecurity-magazine.com Read the original article: Akira Affiliate Crashes Ransomware After Attempting EDR Evasion The post Akira Affiliate Crashes Ransomware After Attempting EDR Evasion appeared first on IT Security News.