Loading story…
A new ransomware group known as Cephalus has emerged, leveraging a custom ransomware strain written in GoLang that employs fake AES keys to hinder malware analysis. The group primarily gains access to victim organizations by exploiting weak Remote Desktop Protocol (RDP) credentials lacking multi-factor authentication, then exfiltrates sensitive data before encrypting systems. Cephalus is financially motivated and has not been linked to any known ransomware-as-a-service (RaaS) operations or alliances with other groups. Their ransom notes openly reference previous attacks and provide links to exfiltrated data as proof of compromise.
Technical analysis reveals that Cephalus ransomware disables Windows Defender’s real-time protection, deletes Volume Shadow Copy Service (VSS) backups, and terminates critical services such as Veeam and MSSQL to maximize the impact of encryption and reduce recovery options. The malware uses a single AES-CTR key for encryption, which is then encrypted with an embedded RSA public key to further complicate decryption efforts. The use of fake AES keys and GoLang-based obfuscation techniques makes dynamic analysis and detection more challenging for defenders.
TTPs, infrastructure, and targeting history in one profile.
3 events from the most recent confirmed update back to the earliest known activity.
AhnLab disclosed technical details on Cephalus ransomware, including its Go-based implementation, fake AES key string used to mislead analysis, defense evasion, backup deletion, service termination, and key protection methods. The company also said it had observed multiple detections and provided sample MD5 hashes and additional indicators through AhnLab TIP.
Early Cephalus operations commonly gained access through stolen RDP credentials on accounts that did not have MFA enabled. After access, the attackers conducted customized victim-specific attacks involving breach activity, data exfiltration, and encryption.
AhnLab reported that Cephalus was first observed in mid-June 2025 as a newly emerged ransomware group. The group presented itself as financially motivated and appeared to conduct targeted intrusions rather than broad opportunistic attacks.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Ransomware operators have been observed using **bring-your-own-vulnerable-driver (BYOVD)** techniques and custom anti-security tools to shut down endpoint protections before encrypting enterprise networks. Kaspersky documented a MedusaLocker intrusion in Brazil in which attackers accessed an SMTP server over RDP with valid administrative credentials, used **Mimikatz** to extract NTLM hashes, and moved laterally with pass-the-hash via PowerShell-based WMI and SMB execution before deploying a new AV-killer tool, `All.exe`. That tool loaded a renamed **TechPowerUp `ThrottleStop.sys`** driver (`ThrottleBlood.sys`), exploited vulnerable IOCTLs for physical memory read/write, hijacked kernel execution through `NtAddAtom`, and repeatedly terminated products from Microsoft Defender, CrowdStrike, SentinelOne, Sophos, Symantec, Bitdefender, ESET, Avast, AVG, McAfee, Panda, Quick Heal, and Kaspersky; the driver issue was assigned **`CVE-2025-7771`**. A separate report on **The Gentlemen** ransomware described a similar pattern in enterprise attacks across the Asia-Pacific region, where the group likely gained entry through an exposed FortiGate device or stolen credentials, then conducted Active Directory reconnaissance, used **PsExec** for lateral movement, established persistence with **AnyDesk**, abused **GPO** and **NETLOGON** for domain-wide deployment, and exfiltrated data with **WinSCP** for double extortion. TrendAI said the group evolved from generic anti-AV tooling to customized variants tailored to the security products installed in each victim environment, while also disabling Windows Defender and recovery mechanisms before dropping `README-GENTLEMEN.txt` and encrypting files with the `.7mtzhh` extension. Together, the incidents show ransomware crews increasingly pairing credential abuse and lateral movement with vulnerable-driver abuse and bespoke defense evasion to maximize encryption success.
Aug 21, 2026
The **Egregor** ransomware operation carried out double-extortion attacks by stealing sensitive data, encrypting victim systems, and threatening to publish stolen information on a leak site if victims refused to pay. Researchers linked Egregor to an ecosystem associated with **Sekhmet** and possible former **Maze** affiliates, with additional reported ties to **ProLock** and **LockBit**. Victims cited in reporting included **GEFCO**, **Barnes & Noble**, and **Ubisoft**, while the group’s leak site reportedly listed **152 victim companies** across industries including information technology, construction, retail, consumer goods, and automotive. Intrusions commonly began with **phishing** or **RDP exploitation**, after which attackers used **Cobalt Strike** for payload delivery and in some cases leveraged **QBot** and living-off-the-land tools such as `bitsadmin`. The malware used heavily obfuscated DLL payloads with **Salsa20**-encrypted configuration data, required a sample-specific launch key passed with the `-p` parameter, and encrypted files with **ChaCha** and **RSA-2048**. Researchers also observed the group using **Rclone** with attacker-supplied configuration data to exfiltrate stolen files, while the ransomware appeared to avoid encrypting systems configured with several CIS-region languages.
Jul 12, 2026
**BlackByte** emerged as a ransomware-as-a-service operation targeting Windows environments across critical infrastructure and other sectors, with victims reported in government facilities, finance, food and agriculture, and broad industry verticals worldwide. U.S. authorities said some intrusions began with exploitation of a Microsoft Exchange vulnerability, while other reporting tied initial access to phishing and **ProxyShell** activity. Once inside, BlackByte operators and affiliates used lateral movement, privilege escalation, scheduled tasks, remote execution, and data theft before encrypting systems and threatening publication on leak sites, with activity concentrated heavily in North America and Europe and notable interest in Latin American targets. Technical analyses show the group rapidly improved its malware after early versions exposed a major weakness: some samples fetched a disguised `forest.png` key file from hardcoded infrastructure and reused the same symmetric key across victims, enabling decryption in certain cases. Later BlackByte variants shifted from C# to **Go**, strengthened cryptography from earlier AES/RSA-based approaches to **Curve25519** and **ChaCha20**, and expanded capabilities including process and service termination, shadow-copy deletion, Defender exclusion changes, AMSI evasion, worm-like propagation through Active Directory and SMB, process injection, and so-called print bombing. Researchers and government agencies also documented use of tools such as **AnyDesk**, **WinRAR**, `certutil`, `vssadmin`, and network scanners, underscoring BlackByte’s progression into a more resilient and operationally mature extortion platform.
Aug 15, 2026