Safe Mode ransomware attacks often use a sequence of commands that execute batch scripts on targeted machines. This is a very simple yet clever attack approach that makes it very difficult to detect. This type of deception is like an enemy combatant putting on the uniform of the army they are fighting against to infiltrate their fortifications. This attack uses normal Windows command features to access Safe Mode that any application could use. The malicious command code automatically reboots the system in Safe Mode, and then the ransomware is able to access and encrypt all of the system’s data. Hackers are able to infiltrate Windows systems by running a small amount of code that won’t trigger a ransomware attack in normal Windows mode and thus, avoid detection from cybersecurity software.

However, bad actors are now taking advantage of Safe Mode vulnerabilities because they know that endpoint security products are unable to run. When a Windows system is in Safe Mode, it is generally considered safe. If security products were allowed to run in Safe Mode, you break the intentions for which Safe Mode was intended, but if you deny security products from running, then you open the security hole and allow attackers to infiltrate the system. If endpoint cybersecurity products were to work in Safe Mode, they would effectively break the system, rendering Safe Mode unsafe. As cybercriminals become stealthier and more evasive, Windows Safe Mode is becoming a growing attack vector.

Malwarebytes safe mode