Cephalus
Ransomware Group Profile
Overview
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Dark Web Infrastructure (2)
cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onion
46.17.42.64.
Activity Timeline
First Seen2025
Last Seen2025
Leak Sites2
Quick Actions