57
60
60
60
60
Akira Ransomware Uses Safe Mode to Bypass EDR
An Akira affiliate rebooted a compromised host into Safe Mode to bypass EDR, but constrained memory crashed the encryptor before encryption completed.
Huntress reports an Akira affiliate gained access on August 4 via an MFA-less SonicWall VPN, enumerated Active Directory, archived file shares with WinRAR, and exfiltrated data to an attacker S3 bucket. The attacker rebooted the host into Safe Mode with Networking and preloaded AnyDesk into the Safe Mode service registry, disabling EDR and Defender's real-time protection for roughly ten minutes. The encryptor failed about 13 seconds after launch with out-of-virtual-memory errors caused by Safe Mode's stripped-down environment, and Defender later removed akira.exe after reboot. Huntress says this is the first observed Safe Mode abuse by Akira, following precedents by Snatch and AvosLocker, and provides detection guidance.
74
60
57
57
57
60
60
57
60
60
60
45
57
Ransomware group claims attack on Missouri’s Cedar County Memorial Hospital after IT outage
Ransomware group claims attack on Cedar County Memorial Hospital in Missouri, forcing IT shutdown that disrupted EHRs and diverted emergency patients.
Cedar County Memorial Hospital in El Dorado Springs, Missouri shut down its IT networks on August 14 after a disruption left its electronic health record system, patient portal, and internet access unavailable. A ransomware group subsequently claimed responsibility for the attack. Diagnostic imaging was also disrupted, preventing transmission of images to radiologists, and the emergency department partially diverted trauma and critical patients.
60
57
57
60
57
60
60
60
57
60
57
60
60
60
⚡ THN Weekly Recap: Top Cybersecurity Threats, Tools and Tips
60
57
57
57
60
57
57
60