Cephalus

Cephalus is a newly observed ransomware strain/group first reported in mid-2025 and seen in incidents in August 2025. It is described as financially motivated and has been associated with targeted intrusions in which operators breach victims, exfiltrate data, and then encrypt systems. Reported initial access commonly involved compromised RDP accounts without MFA. In observed incidents, attackers also used the MEGA cloud platform, likely for data exfiltration, and the ransom note provided a GoFile link and password as proof of stolen data. Cephalus has also been cited among emerging ransomware groups contributing to increased attacks in sectors including healthcare.

Technically, Cephalus is written in Go. In Huntress-observed incidents, it was launched via DLL sideloading using the legitimate SentinelOne executable SentinelBrowserNativeHost.exe, executed from a user Downloads directory, which loaded SentinelAgentCore.dll and then a data.bin payload containing the ransomware. One deployment was reportedly blocked when Microsoft Defender quarantined the file. The malware disables or weakens Microsoft Defender protections, including adding exclusions, modifying Defender-related registry keys, stopping and disabling services such as SecurityHealthService, Sense, WinDefend, and WdNisSvc, deleting Volume Shadow Copies with vssadmin delete shadows /all /quiet, and stopping services including Veeam and MSSQL to hinder recovery.

Cephalus includes anti-analysis and key-protection features. AhnLab reported that it generates a fake AES key string ("FAKE_AES_KEY_FOR_CONFUSION_ONLY!") repeatedly to mislead dynamic analysis. It encrypts files with a single AES-CTR key derived by repeated SHA-256 hashing of a random 32-byte value, and then encrypts that AES key with an embedded RSA public key. The malware uses memory-protection techniques including VirtualLock and XOR masking to reduce key exposure in memory or paging files. The ransom note is named recover.txt and is created in directories where encryption completes. Reported indicators associated with Cephalus include MD5 hashes 6221b0bf4d365454d40c546cf7133570 and a16a1228d5276eec526c21432a403923.