The recent incident involving an Akira ransomware affiliate's attempt to evade security measures has revealed a fascinating yet concerning development in the world of cybersecurity. This particular attack, as detailed by Huntress, showcases the evolving tactics employed by threat actors and the potential vulnerabilities within our systems.
The affiliate's initial breach involved a credential spraying attack, exploiting a SonicWall SSL VPN without multifactor authentication (MFA). This is a common entry point for attackers, highlighting the importance of implementing robust MFA protocols. Once inside, the attacker followed a familiar playbook, accessing the domain controller via Remote Desktop Protocol (RDP) and engaging in Active Directory (AD) enumeration.
What sets this attack apart is the subsequent attempt to evade detection. The threat actor, before deploying the ransomware payload, employed a technique that deviated from the typical Akira strategy. They used msconfig.exe to force a reboot into 'Safe Mode with Networking', a move that has been associated with groups like Snatch and AvosLocker for years. This approach, listed by MITRE ATT&CK as 'Impair Defences: Safe Mode Boot', aims to disable third-party services and security tools, including EDR and AV solutions.
However, the attacker's plan backfired, leading to an unexpected outcome. By triggering host memory errors, the Safe Mode environment, with its stripped-down resources and constrained virtual memory, inadvertently prevented the ransomware from encrypting the target's files. This fortunate outcome highlights the importance of understanding the intricate relationship between system configurations and malware behavior.
Huntress emphasizes that this incident serves as a reminder of the ongoing arms race between attackers and defenders. While the Safe Mode technique may have temporarily blinded security controls, it also underscores the need for organizations to adopt comprehensive security measures. The report provides valuable insights into how to fortify defenses against such attacks, including blocking credential spray attacks, deploying MFA, and monitoring system configurations for suspicious activities.
In conclusion, this incident underscores the dynamic nature of cybersecurity threats and the importance of staying vigilant. As attackers adapt their strategies, organizations must continually evolve their security practices to stay one step ahead. By learning from these incidents and implementing the recommended safeguards, we can collectively strengthen our defenses against ransomware and other emerging cyber threats.
