Cephalus
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Victims
19
First Discovered
2025-08-26
victim
Last Discovered
2025-08-29
victim
Inactive Since
257
days
Avg Delay
32.5
days
Infostealer
5.3%
victims with domain
Countries
5
hit
Attack Velocity — Last 12 months
Known Locations (2)
| Favicon | Title | Type | Available | Last Visit | Server Info | FQDN | |
|---|---|---|---|---|---|---|---|
|
Cephalus | No | 2026-04-28T07:22:58 |
cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onion
|
|||
|
Cephalus | No | 2026-04-28T07:25:19 |
46.17.42.64.
|
Target
Top 5 Activity Sectors
- Business Services 5
- Healthcare 4
- Financial Services 2
- Technology 2
- Manufacturing 1
Top 5 Countries
-
United States
13
-
United Kingdom
2
-
Ireland
1
-
Netherlands
1
-
Japan
1
Heatmap
YARA Rules (1)
Indicators of Compromise (IoCs) (1)
Victims (19)
We have got all the software and hardware code,and got 800G+ of internal data. The link will coming …
We got a total of 1.8TB+ of data,including project,clients,employee information,and a certain countr…
K Strategies Marketing and Public Relations LEAK | 900+GB…
