Akira: Intrusion Stopping EDR via Safe Mode and Exfiltrating Data Before Encryption ...
An Akira ransomware affiliate disabled the endpoint detection and response (EDR) solution on a compromised system by restarting the machine into Safe Mode with Networking.
Gives a whole new meaning to Safe Mode
First Akira Safe Mode attack disables endpoint detection and response but fails to encrypt, Huntress says - SiliconANGLE