Ransomware Now Reboots Into Safe Mode to Kill Your EDR

Akira and other ransomware operators have found a reliable way to blind your defenses before they encrypt anything. They reboot the machine into Windows Safe Mode with Networking, a state where most endpoint detection and response (EDR) agents simply don't run. Fixing this doesn't require a new tool. It requires closing the specific configuration gaps that make the trick possible.

What's actually happening

Safe Mode exists for troubleshooting. Windows starts with a minimal set of drivers and services, deliberately excluding most third-party software. That's useful when you're diagnosing a stuck update. It's also useful to an attacker, because most EDR and antivirus agents are third-party services, and in Safe Mode they often never load in the first place.

Akira has been observed using this to its advantage. Once an attacker has admin-level access to a network, usually after credential theft, an exposed remote access tool, or a known vulnerability, they push a scheduled task or use built-in Windows commands to force affected machines to reboot into Safe Mode with Networking. The "with Networking" part matters: it keeps enough connectivity alive for the ransomware binary to reach out, drop payloads, or coordinate encryption across multiple hosts, while the security tooling that would normally stop it stays dark.

Why Safe Mode beats most EDR tools

This isn't a flaw in any one vendor's product. It's a gap in how Windows boot modes and third-party services interact. A few things make it effective:

• Service load order. Safe Mode only starts services explicitly flagged to run in that mode. Most EDR agents aren't configured that way by default.

• Local admin rights are the key. Forcing a Safe Mode boot and disabling recovery options typically requires local administrator access, which is exactly the level of access ransomware crews work to obtain before the final encryption stage.

• It's quiet. A reboot into Safe Mode can look like routine IT activity if nobody's watching for it specifically. By the time anyone notices something's wrong, encryption is already running.

The takeaway for a business owner or IT leader: your EDR license does its job right up until the moment an attacker with admin rights decides which mode Windows boots into. Prevention has to happen earlier in the chain.

Closing the gap: what to do this week

You don't need a large security team to meaningfully reduce this risk. A few concrete steps:

• Restrict who can force a reboot into Safe Mode. Group Policy can block boot configuration changes (via bcdedit) for standard users, and you can tighten which accounts hold local admin rights on endpoints in the first place. Fewer standing admins means fewer paths to this technique.

• Check your EDR vendor's tamper protection and Safe Mode options. Several modern EDR platforms now support running in Safe Mode or alerting on unexpected boot-mode changes. If yours does, confirm it's actually turned on. This is often an opt-in setting, not a default.

• Monitor for the behavior, not just the malware. Unexpected use of bcdedit, unplanned reboots across multiple machines in a short window, or scheduled tasks that modify boot configuration are early warning signs, well before encryption starts.

• Segment and back up properly. Immutable, offline-reachable backups remain the difference between a bad week and a business-ending event, regardless of how the endpoint defenses were bypassed.

• Patch the access points attackers use to get admin rights in the first place. Exposed RDP, unpatched VPN appliances, and weak or reused credentials remain the most common way ransomware crews get the foothold this whole technique depends on.

Most of this is configuration and process work, not new spend. It gets missed not because it's exotic, but because nobody owns the question: who can reboot our servers into Safe Mode, and would we notice?

When prevention isn't enough

No control set is airtight, which is why detection and response matter as much as prevention. In one engagement with a venture-backed technology company that had no dedicated security hire, our team found and remediated hundreds of cloud misconfigurations across AWS and GCP, brought endpoint coverage to 100%, and contained an active intrusion in progress. You can read the details in our case study. The pattern holds regardless of the specific ransomware technique: gaps compound quietly until someone with admin-level access finds them.

If you're not confident your organization would catch a forced Safe Mode reboot, or you're not sure who currently holds local admin rights across your fleet, a penetration test is the fastest way to find out where the real gaps are. And if ransomware does hit, having an incident response plan and partner in place before it happens is what turns a crisis into a contained event. For general guidance on ransomware readiness, CISA's #StopRansomware resources are a solid public reference.

We favour fixing issues over flagging them. Every finding we surface gets verified as remediated, not just logged. If you want a clear view of where your organization stands, start with a free security review. It's a straight answer on where you're exposed.