The method shouldn’t be fully new. Huntress pointed to ransomware households, together with Snatch and AvosLocker, which have used Protected Mode to disable defenses for years. MITRE ATT&CK tracks the behaviour as T1688, impair Defenses: Protected Mode Boot.
Akira selecting up the method now aligns with its current makes an attempt to function exterior EDR protection. Earlier this yr, an Akira affiliate was reported creating a brand new digital machine on a sufferer’s hypervisor particularly to run the encryptor the place Huntress was not put in.
The anti-EDR transfer by chance stopped the ransomware
The method, nevertheless, didn’t produce the result the attacker needed, Northey famous. After “akira.exe” launched in Protected Mode, the system started reporting digital reminiscence failures. Huntress noticed “Digital Reminiscence Minimal Too Low” and “Out of Digital Reminiscence” errors, adopted by PowerShell failures.
