New Cephalus Ransomware Uses Fake AES Keys and GoLang to Thwart Analysis

Researchers from AhnLab Security Emergency Response Center (ASEC) have identified a new ransomware group named “Cephalus,” which surfaced in mid-June 2025 and uses Go-based ransomware with anti-analysis features. According to AhnLab’s report, Cephalus’ operators rely on brute-forcing or purchasing compromised RDP credentials to enter networks, exfiltrate data, then encrypt files and threaten leaks.

The ransomware creates fake AES keys to confuse analysts: when executed, it generates a 1,024-byte random buffer and overwrites it with a 32-byte string reading “FAKE_AES_KEY_FOR_CONFUSION_ONLY!” — repeated 100 times — to scatter decoy values in memory. It uses AES-CTR with a single symmetric key for all files, protected by an embedded RSA public key, and stores the key in a custom SecureMemory structure with memory obfuscation using XOR against a random mask.

Prior to encryption, Cephalus disables recovery tools and backup mechanisms, including Windows Defender real-time protection, and deletes Volume Shadow Copies, while terminating processes for Veeam and MSSQL to hinder restoration. The note, recover.txt, is left in each directory, with links to GoFile or dark web portals as proof of exfiltration, and AhnLab notes there are currently no confirmed ties to existing ransomware cartels.