Akira ransomware scum blocked victim's security tools – and broke their own encryptor
Gives a whole new meaning to Safe Mode
An Akira ransomware affiliate rebooted a victim’s computer into Safe Mode to kill its security tools – and in the process sabotaged their own malware when the limited-function startup mode also broke their encryptor.
But the ending wasn't entirely happy for the victim. The attacker had already stolen credentials and data from file shares before Safe Mode prevented the ransomware from doing its job.
Huntress security operations analyst James Northey detailed the incident in a Wednesday blog and cautioned that this was more likely a memory-configuration issue, and shouldn't be taken as a practical defense to prevent Akira ransomware from locking up valuable files.
“Ultimately this could be a case of winning the battle, but not the war,” Northey said on Wednesday in a blog shared with The Register.
“It’s possible that a host with more physical memory or a larger page...
Copyright of this story solely belongs to theregister.com. To see the full text click HERE
