Cephalus
Cephalus is a ransomware group with a financial motive, tracked by Brandefense. It targets 7 sectors, including Government and Technology, in 4 countries, including the United States and the United Kingdom. It uses 3 MITRE ATT&CK techniques.
- Techniques
- 3
- Exploited CVEs
- No CVE data
- First seen
- Jun 1, 2025
- Last seen
- Nov 1, 2025
- Record updated
Who They Target.
About Cephalus.
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Last updated Oct 1, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.