Cephalus: The New Ransomware That Abuses Legitimate Tools to Bypass Security

Threat hunters at Huntress observed two separate incidents involving a new ransomware variant dubbed Cephalus, which entered networks through compromised RDP accounts without MFA. Once inside, the attackers used the MEGA cloud storage platform for data exfiltration, a step described as part of a double-extortion approach to pressure victims.

Cephalus deploys its payload by sideloading a dynamic link library (DLL) via a legitimate SentinelOne executable file (SentinelBrowserNativeHost.exe) and then loading a data[.]bin file containing the ransomware code, allowing the malicious activity to blend with trusted security tooling.

The malware then executes a sequence of commands to hinder recovery and disable protections, including vssadmin delete shadows /all /quiet, multiple PowerShell commands to add Windows Defender exclusions, registry modifications to disable real-time protection, and stopping Defender-related services. According to Huntress, these commands occur prior to file encryption and ransom note creation.

The observed ransom notes referenced news articles about Cephalus to lend credibility, and victims were provided with a GoFile[.]io repository link and password to verify samples of stolen data. The article, dated 27 August 2025, urges organisations to enforce MFA on RDP accounts and maintain layered security to mitigate threats like Cephalus.