Akira Ransomware Attack: SonicWall VPN Exploitation and EDR Evasion (August 2026)

Organization: What Happened

On August 4, 2026, an unidentified organization was targeted in a confirmed Akira ransomware incident. Attackers leveraged a credential-spraying attack against the organization's SonicWall SSL VPN, successfully accessing an account that lacked multi-factor authentication (MFA). Once inside, the threat actors established persistent access, exfiltrated sensitive files to an attacker-controlled bucket, and deployed the Akira ransomware payload. The ransomware attempted to maximize its impact by rebooting the affected Windows system into Safe Mode, aiming to disable endpoint detection and response (EDR) protections. However, the encryption phase was ultimately unsuccessful due to resource constraints on the compromised system, resulting in only partial operational disruption.

Attack Vector & Technical Detail

The initial intrusion was achieved through credential-spraying against the SonicWall SSL VPN, exploiting weak authentication practices and the absence of MFA on at least one user account. After gaining access, the attackers maintained persistence and moved laterally within the environment. The Akira ransomware variant used in this attack is notable for its Safe Mode execution technique, designed to evade EDR and other security controls that may not run in this mode. The incident aligns with MITRE ATT&CK tactic T1688 (Initial Access: Valid Accounts), reflecting the use of legitimate credentials for unauthorized access. No specific CVEs or IOCs were reported in the available data, but the operational sequence and Safe Mode evasion are consistent with recent Akira campaigns.

Confirmed Impact

The primary impact was the theft of sensitive organizational data, which was exfiltrated to an attacker-controlled storage bucket prior to ransomware deployment. The attempted encryption phase caused partial disruption to business operations but was ultimately unsuccessful due to system resource limitations. The incident demonstrates the risk of data compromise even when ransomware encryption fails, as attackers may still leverage stolen data for extortion. The global nature of SonicWall SSL VPN deployments suggests that similar organizations may be at risk, especially where MFA is not enforced. Regulatory exposure may arise from the confirmed data exfiltration, depending on the jurisdiction and the nature of the compromised information.

What This Means for Your Organization

This incident highlights the critical importance of enforcing MFA on all remote access solutions, particularly VPNs, to prevent credential-based attacks. Organizations relying on SonicWall SSL VPNs or similar technologies should review authentication policies and ensure that strong, unique credentials are enforced. The use of Safe Mode by ransomware actors to bypass EDR underscores the need for layered defenses, including solutions capable of detecting malicious activity even during Safe Mode operation. Regular monitoring for unusual authentication attempts and robust incident response playbooks are essential to mitigate the risk of similar attacks.

Detection & Response

• Immediate: Audit all VPN accounts for MFA enforcement and disable any accounts without MFA.
• Hunt: Investigate for signs of credential-spraying activity and anomalous Safe Mode reboots on critical systems.
• Patch: N/A (no specific CVE identified in this incident).

Source: https://www.csoonline.com/article/4209606/akira-ransomware-reboots-into-windows-safe-mode-to-knock-edr-offline.html