A recent change to the REvil ransomware allows the threat actors to automate file encryption via Safe Mode after changing Windows passwords. […]

from https://www.bleepingcomputer.com/news/security/revil-ransomware-now-changes-password-to-auto-login-in-safe-mode/