Threat Actors Use Stolen RDP Credentials to Deploy Cephalus Ransomware

A new ransomware group, Cephalus, has emerged in the threat landscape, targeting organisations via compromised Remote Desktop Protocol (RDP) accounts, and was first detected in mid-June 2025. The group’s operations begin with stealing credentials from RDP accounts that lack multi-factor authentication, then deploy a customised ransomware designed for specific targets. Cephalus encrypts data after breaching a system and exfiltrating sensitive information, often displaying ransom notes to pressure victims.

Technically, the ransomware is built in Go and uses AES-CTR encryption with a single key, while actively disabling Windows Defender’s real-time protection and deleting Volume Shadow Copy Service backups to hinder recovery; it also terminates services such as Veeam backups and Microsoft SQL Server databases to maximise encryption success. The operators claim sole financial motivation and tailor their malware to each victim, sometimes linking to GoFile repositories showing exfiltrated data prior to encryption.