Nightspire - Safe Mode Boot Modification

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•2

Detects Nightspire ransomware configuring the machine to boot into Safe Mode with Networking to bypass third-party EDR/AV solutions before initiating the encryption routine. This is achieved by executing 'bcdedit.exe' with parameters to set 'safeboot network'.