cephalus Ransomware Group

Key insights

• •Initial access is gained through compromised Remote Desktop Protocol (RDP) accounts lacking multi-factor authentication.
• •The group uses a custom ransomware which encrypts files with a '.sss' extension and employs a hybrid encryption scheme using AES-CTR and RSA.
• •Cephalus employs DLL sideloading via legitimate SentinelOne executables for deploying their ransomware payload.
• •The group operates on a double-extortion model, exfiltrating sensitive data to cloud storage before encryption.
• •Ransom notes often include psychological pressure tactics, referencing previous attacks or proof of stolen data.
• •They aggressively disable Windows Defender and utilize PowerShell commands to evade detection.