Ransomware gang crashes own attack — with no-one to blame but themselves
- Akira ransomware tried Safe Mode boot to disable defenses but broke its own encryptor
- Defender later flagged and quarantined payload, leaving attackers with only stolen data
- Huntress advises VPN brute‑force alerts, MFA, SIEM logging, and Safe Mode monitoring
A recent ransomware attack saw the operators Akira (figuratively) shoot themselves in the foot - and they still walked away with sensitive data, albeit limping.
Akira is a well-known ransomware group, considered one of the most active cybercriminal organizations on the internet. Its modus operandi is simple in theory: they look for an exposed VPN instance (for example, one with a default or weak password), access the domain controller, enumerate Active Directory, steal sensitive data, and deploy an encryptor.
With the encryptor they leave a ransom note, instructing the victim to reach out and negotiate a payment in exchange for the decryption key and for deleting the stolen documents and information.
However,...
Copyright of this story solely belongs to techradar.com. To see the full text click HERE
