Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

Observations

What went wrong, and what to do about it

Real breaches, each put through the same four questions: one control that worked, one that did not, one number worth watching, and what should have been done instead. Every entry cites a primary source, because the point of this section is that you can take it to a meeting.

NO. 09/Cross-sector/11 September 2026

Akira Hits Safe Mode: Ransomware Rebooting Around EDR

Huntress, 12 August 2026

After gaining access via an exposed SonicWall VPN, an Akira affiliate rebooted the victim host into Safe Mode with Networking to defeat EDR, a first for this ransomware variant in our telemetry. Safe Mode is a boot mode that only loads essential drivers and services, disabling most third-party software. As such, the reboot stopped the Huntress agent and disabled Microsoft Defender's real-time protection; Defender couldn't quarantine the file until the attacker rebooted back to normal mode.

What worked

Huntress records one thing that held. “Eventually, a scheduled Defender scan detected the ransomware binary at 07:43:50 UTC.”

What failed

Huntress groups the failures under four headings: initial access: SonicWall SSL VPN, no MFA; living on the domain controller: recon, the akira way; collection and exfiltration: WinRAR to the cloud; and AnyDesk: the delivery and c2 channel. “The intrusion started where many Akira intrusions start: a SonicWall SSL VPN. Beginning around 03:45 UTC on August 4, 2026, the SonicWall logged a burst of failed logins (Unknown User Login Attempt / "User login denied due to bad credentials") against multiple usernames from several external IPs: a straightforward credential spray.”

The number

10 minutes

This AnyDesk session (including the preceding Safe Mode reboot) lasted less than 10 minutes, showing how well-oiled these Akira intrusions have become.

What to do instead

Catch the credential spray before it becomes a foothold: Alert on bursts of failed VPN logins against multiple usernames from one source. Correlate those failures with a successful login from the same IP or ASN within a short window.

Sources

Named for the doctrine distinction between a lesson observed and a lesson learned: a lesson is not learned until behaviour has changed and somebody has checked. Pretending otherwise is how the same finding turns up in three consecutive post-incident reports.