# T1688 Safe Mode Boot > As of 2026-10-05, T1688 (Safe Mode Boot) appears in 10 tracked threats, first reported 2026-02-04 and most recently 2026-09-18, with linked actors including Akira, LockBit, Storm-1567; it most often appears alongside T1059.001 (PowerShell). - **Tracked threats:** 10 (1 critical, 7 high, 2 medium) - **First seen:** 2026-02-04 - **Last seen:** 2026-09-18 - **Threat actors:** 12 - **Detection rules:** 8 (counts only; Blue tier and above) ## Key facts - **ID:** T1688 - **Framework:** MITRE ATT&CK - **Tactics:** Defense Impairment - **Matrix:** Enterprise - **Data as of:** 2026-10-05 - **MITRE:** https://attack.mitre.org/techniques/T1688/ ## Activity timeline T1688 first appeared in tracked threats on 2026-02-04 and was most recently reported on 2026-09-18. The busiest month was 2026-08 with 3 reports, and 10 of the 10 threats were reported in the twelve months to 2026-09. ## How adversaries use it T1688 Safe Mode Boot is catalogued by MITRE ATT&CK under the Defense Impairment tactic in the Enterprise matrix. Threadlinqs maps 10 of 2623 tracked threats (0.4%) to it; by severity that is 1 critical, 7 high, 2 medium. Threats that use T1688 most often also use [T1059.001 PowerShell](https://intel.threadlinqs.com/technique/T1059.001) (7 threats), [T1489 Service Stop](https://intel.threadlinqs.com/technique/T1489) (6 threats), [T1685 Disable or Modify Tools](https://intel.threadlinqs.com/technique/T1685) (6 threats), [T1021.002 SMB/Windows Admin Shares](https://intel.threadlinqs.com/technique/T1021.002) (5 threats), [T1027 Obfuscated Files or Information](https://intel.threadlinqs.com/technique/T1027) (5 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed. 12 tracked threat actors appear in the threats that use T1688; the most frequent are [Akira](https://intel.threadlinqs.com/actor/Akira) (2), [LockBit](https://intel.threadlinqs.com/actor/LockBit) (2), [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) (2), [VECT](https://intel.threadlinqs.com/actor/VECT) (2), [CUBA](https://intel.threadlinqs.com/actor/CUBA) (1). ## Threat actors using it - [Akira](https://intel.threadlinqs.com/actor/Akira) — 2 - [LockBit](https://intel.threadlinqs.com/actor/LockBit) — 2 - [Storm-1567](https://intel.threadlinqs.com/actor/Storm-1567) — 2 - [VECT](https://intel.threadlinqs.com/actor/VECT) — 2 - [CUBA](https://intel.threadlinqs.com/actor/CUBA) — 1 - [DevMan](https://intel.threadlinqs.com/actor/DevMan) — 1 - [MedusaLocker](https://intel.threadlinqs.com/actor/MedusaLocker) — 1 - [Nitrogen](https://intel.threadlinqs.com/actor/Nitrogen) — 1 - [NoName057(16)](https://intel.threadlinqs.com/actor/NoName057(16)) — 1 - [Qilin](https://intel.threadlinqs.com/actor/Qilin) — 1 - [REvil](https://intel.threadlinqs.com/actor/REvil) — 1 - [Scattered Spider](https://intel.threadlinqs.com/actor/Scattered%20Spider) — 1 ## Tracked threats 10 tracked threats use T1688. - [France Dark Web Threat Landscape: Ransomware and Hacktivist Activity Surges 4x Over 24 Months](https://intel.threadlinqs.com/threat/TL-2026-2564) — high — 2026-09-18 - [Sality P2P Botnet Disrupted by Law Enforcement and CrowdStrike via Peer-List Sinkholing](https://intel.threadlinqs.com/threat/TL-2026-2284) — high — 2026-09-01 - [VECT 2.0 Ransomware's Nonce-Reuse Flaw Turns It Into an Accidental Wiper for Files Over 128KB](https://intel.threadlinqs.com/threat/TL-2026-2116) — high — 2026-08-22 - [Akira Ransomware Affiliate Forces Windows Safe Mode Reboot to Disable EDR, Exfiltrates Data via…](https://intel.threadlinqs.com/threat/TL-2026-2010) — high — 2026-08-13 - [Akira Ransomware Reboots Victims into Safe Mode to Blind EDR and Windows Defender](https://intel.threadlinqs.com/threat/TL-2026-2062) — high — 2026-08-12 - [Proofpoint AI Era Ransomware Report: 37% of Paying Victims Face Repeat Extortion Demands](https://intel.threadlinqs.com/threat/TL-2026-1710) — medium — 2026-07-22 - [Armenia Detains Russian National Aleksandr Ermakov on US Extradition Request Tied to Sodinokibi/REvil…](https://intel.threadlinqs.com/threat/TL-2026-1446) — medium — 2026-07-17 - [VECT 2.0 / DEVMAN 3.0 Ransomware — Design-Flawed ChaCha20 Encryption Irreversibly Destroys Files Over 128KB…](https://intel.threadlinqs.com/threat/TL-2026-0697) — high — 2026-06-06 - [Ransomware Threat Landscape 2025-2027 — RaaS Destabilization, Conti Leak Cascade, ESXi Hypervisor Targeting…](https://intel.threadlinqs.com/threat/TL-2026-0115) — critical — 2026-02-06 - [BYOVD EDR Killer Tooling — Ransomware Groups Weaponizing Signed Kernel Drivers to Blind Endpoint Detection](https://intel.threadlinqs.com/threat/TL-2026-0091) — high — 2026-02-04 ## Related CVEs CVEs referenced by the tracked threats that use T1688, most frequent first. - [CVE-2015-2291](https://intel.threadlinqs.com/cve/CVE-2015-2291) - [CVE-2018-13379](https://intel.threadlinqs.com/cve/CVE-2018-13379) - [CVE-2023-0669](https://intel.threadlinqs.com/cve/CVE-2023-0669) - [CVE-2023-27350](https://intel.threadlinqs.com/cve/CVE-2023-27350) - [CVE-2023-4966](https://intel.threadlinqs.com/cve/CVE-2023-4966) - [CVE-2023-4967](https://intel.threadlinqs.com/cve/CVE-2023-4967) ## Detection coverage Threadlinqs maintains 8 detection rules mapped to T1688 (SPL 2, KQL 3, Sigma 3). Rule content is available to Blue tier accounts and above; this page shows counts only. 8 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing ## Links - Canonical page: https://intel.threadlinqs.com/technique/T1688 - All techniques: https://intel.threadlinqs.com/techniques - Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)