Cephalus is a Go-based ransomware group active since mid-June 2025 that breaches organizations mainly by compromising RDP accounts lacking MFA, exfiltrates data, and performs targeted encryption using a custom ransomware that disables protections and deletes backups. The malware uses a single AES-CTR key protected by memory-locking and XOR masking, generates fake AES key artifacts to evade dynamic analysis, and posts proof of breaches (e.g., GoFile links) to pressure victims. #Cephalus #GoFile
Keypoints
- Cephalus first appeared in mid-June 2025 and claims motivation is purely financial, targeting organizations via compromised RDP accounts without MFA.
- The group performs targeted intrusions that include data exfiltration, public proof of theft (GoFile links), and then encrypts victim data to extort payment.
- Cephalus ransomware is written in Go and employs anti-analysis techniques such as generating a repeated fake AES key to confuse dynamic analysis.
- On execution, the ransomware disables Windows Defender real-time protection, deletes VSS backups, and stops services like Veeam and MSSQL to hinder recovery.
- Encryption uses a single AES-CTR key derived via repeated SHA-256 iterations; that key is protected using SecureMemory methods (memory locking and XOR masking) and then encrypted with an embedded RSA public key.
- No confirmed evidence yet about Cephalus operating as RaaS, rebranding history, subgroups, or alliances with other ransomware actors.
- Ransom notes named “recover.txt” are dropped in encrypted directories and the group publicly references prior damages to pressure victims.
MITRE Techniques
- [T1078] Valid Accounts – Used by compromising RDP accounts without MFA to gain initial access (“breaching organizations is by stealing credentials through Remote Desktop Protocol (RDP) accounts that do not have multi-factor authentication (MFA) enabled”).
- [T1005] Data from Local System – Exfiltration and theft of victim data prior to encryption (“breaches them, exfiltrates their data, and then encrypts it”).
- [T1486] Data Encrypted for Impact – Encrypts files using AES-CTR with a single key to deny access (“uses a single AES-CTR key for encryption… if an attacker can obtain the AES-CTR key, they can decrypt all encrypted files”).
- [T1490] Inhibit System Recovery – Deletes VSS backups and stops backup services like Veeam and MSSQL to prevent recovery (“deletes VSS backups, and stops key services such as Veeam and MSSQL to increase its encryption success rate and decrease the chances of recovery”).
- [T1112] Modify Registry (privilege/defense evasion) / [T1562.001] Impair Defenses:Disable or Modify Tools – Disables Windows Defender real-time protection to evade detection (“upon execution, it disables Windows Defender’s real-time protection”).
- [T1496] Resource Hijacking / Anti-Analysis Techniques – Employs fake AES key generation and repeated memory accesses to confuse dynamic analysis (“generates a 1,024-byte random buffer… overwrites this buffer with a 32-byte string that reads ‘FAKE_AES_KEY_FOR_CONFUSION_ONLY!’—a process that is repeated 100 times”).
- [T1140] Deobfuscate/Decode Files or Information – Uses XOR masking and SecureMemory methods to hide the AES key in memory and reduce exposure (“SetData()/GetData() methods… generates a random XOR key and performs an XOR operation once before storing it”).
- [T1552] Unsecured Credentials – Exploits lack of MFA on RDP accounts as an access vector (“RDP accounts that do not have multi-factor authentication (MFA) enabled”).
Indicators of Compromise
- [File Hash ] Malware samples detected by AhnLab – MD5: 6221b0bf4d365454d40c546cf7133570, a16a1228d5276eec526c21432a403923.
- [File Name ] Ransom note created after encryption – recover.txt (created in all directories where encryption completed).
- [Platform/Repository ] Proof of exfiltration hosting – GoFile links used to demonstrate stolen data (examples cited: GoFile repository links for leakage evidence).
- [Detection Names ] AV/EDR signatures – AhnLab detections such as Ransomware/Win.Cephalus.C5792414 and SystemManipulation/EDR.Event.M2486 (engine dates provided in source).
Read more: https://asec.ahnlab.com/en/90878/