Akira Hits Safe Mode: Ransomware Rebooting Around EDR

An Akira ransomware affiliate exploited a SonicWall VPN to infiltrate a network, then attempted a novel evasion by rebooting into Safe Mode with Networking to disable security defenses—only for the ransomware deployment to fail due to memory constraints, though sensitive data had already been exfiltrated for extortion.