Akira Hits Safe Mode: Ransomware Rebooting Around EDR

An Akira affiliate rebooted into Safe Mode to kill EDR and Defender, then Safe Mode broke their own ransomware. Here’s the full attack chain.