Cephalus Ransomware Exploits RDP for Initial Access in Latest Attack Campaign

Cybersecurity researchers at Huntress identified a novel Cephalus ransomware variant deployed in two incidents targeting organisations with weak access controls, using exposed RDP endpoints as the initial access vector and compromised credentials without MFA.

According to Huntress, the attacks occurred on August 13 and 16, involved data exfiltration via the MEGA cloud storage platform, and used a DLL sideloading technique through a legitimate SentinelOne executable, SentinelBrowserNativeHost.exe, to launch the ransomware payload. Cephalus encrypts files with a .sss extension and leaves a ransom note named recover.txt, with recovery options undermined by a series of commands that disable Defender features and attempt to erase Shadow Copies.

In one incident, Microsoft Defender quarantined the payload, preventing full encryption, while the other led to successful file locking and exfiltration. The campaign underscores a broader trend of abusing legitimate tools to evade detection, and Huntress notes that threat actors sometimes combine reconnaissance with rapid deployment before EDR systems can intervene. The report also highlights the importance of least-privilege access and monitoring RDP exposures in defending against such attacks.