{
	"id": "d58762c3-a037-46c1-94eb-3683d8a1032b",
	"created_at": "2026-04-06T00:13:22.051553Z",
	"updated_at": "2026-04-10T03:24:29.251772Z",
	"deleted_at": null,
	"sha1_hash": "4ffdafdfd801906febc554b1ee8655fa172640ef",
	"title": "REvil ransomware now changes password to auto-login in Safe Mode",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 2172103,
	"plain_text": "REvil ransomware now changes password to auto-login in Safe Mode\r\nBy Lawrence Abrams\r\nPublished: 2021-04-07 · Archived: 2026-04-05 16:37:57 UTC\r\nA recent change to the REvil ransomware allows the threat actors to automate file encryption via Safe Mode after changing\r\nWindows passwords.\r\nIn March, we reported on a new Windows Safe Mode encryption mode added to the REvil/Sodinokibi ransomware. This\r\nmode can be enabled using the -smode command-line argument, which would reboot the device into Safe Mode, where it\r\nwould perform the encryption of files.\r\nIt is believed that this mode was added as a way to evade detection by security software and to shut down backup software,\r\ndatabase servers, or mail servers to have greater success when encrypting files.\r\nhttps://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/\r\nPage 1 of 4\n\n0:00\r\nhttps://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/\r\nPage 2 of 4\n\nVisit Advertiser websiteGO TO PAGE\r\nHowever, at the time of our reporting, the ransomware required someone to manually login to Windows Safe mode before\r\nthe encryption would start, which could raise red flags.\r\nNew version automatically logs Windows into Safe Mode\r\nAt the end of March, a new sample of the REvil ransomware was discovered by security researcher R3MRUM that refines\r\nthe new Safe Mode encryption method by changing the logged-on user's password and configuring Windows to\r\nautomatically login on reboot.\r\nWith this new sample, when the -smode argument is used, the ransomware will change the user's password to\r\n'DTrump4ever.'\r\nThe ransomware then configures the following Registry values so that Windows will automatically login with the new\r\naccount information.\r\n[HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon]\r\n\"AutoAdminLogon\"=\"1\"\r\n\"DefaultUserName\"=\"[account_name]\"\r\n\"DefaultPassword\"=\"DTrump4ever\"\r\nWhile it unknown if new samples of the REvil ransomware encryptor continue to use the 'DTrump4ever' password, at least\r\ntwo samples uploaded to VirusTotal in the past two days continue to do so.\r\nThese changes illustrate how ransomware gangs continuously evolve their tactics to successfully encrypt victims' devices\r\nand force a ransom payment.\r\nREvil also recently warned that they would perform DDoS attacks on victims and email victims' business partners about\r\nstolen data if a ransom is not paid.\r\nAutomated Pentesting Covers Only 1 of 6 Surfaces.\r\nhttps://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/\r\nPage 3 of 4\n\nAutomated pentesting proves the path exists. BAS proves whether your controls stop it. Most teams run one without the\r\nother.\r\nThis whitepaper maps six validation surfaces, shows where coverage ends, and provides practitioners with three diagnostic\r\nquestions for any tool evaluation.\r\nSource: https://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/\r\nhttps://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/\r\nPage 4 of 4",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/"
	],
	"report_names": [
		"revil-ransomware-now-changes-password-to-auto-login-in-safe-mode"
	],
	"threat_actors": [
		{
			"id": "aa73cd6a-868c-4ae4-a5b2-7cb2c5ad1e9d",
			"created_at": "2022-10-25T16:07:24.139848Z",
			"updated_at": "2026-04-10T02:00:04.878798Z",
			"deleted_at": null,
			"main_name": "Safe",
			"aliases": [],
			"source_name": "ETDA:Safe",
			"tools": [
				"DebugView",
				"LZ77",
				"OpenDoc",
				"SafeDisk",
				"TypeConfig",
				"UPXShell",
				"UsbDoc",
				"UsbExe"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434402,
	"ts_updated_at": 1775791469,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/4ffdafdfd801906febc554b1ee8655fa172640ef.pdf",
		"text": "https://archive.orkl.eu/4ffdafdfd801906febc554b1ee8655fa172640ef.txt",
		"img": "https://archive.orkl.eu/4ffdafdfd801906febc554b1ee8655fa172640ef.jpg"
	}
}