Cephalus Ransomware Emerges as a Go-Based Threat Targeting Windows Networks A new ransomware strain, Cephalus, written in Go, has been active since at least June 2025, with broader public reporting surfacing in August 2025. The malware targets Windows networks, employing a double-extortion tactic stealing sensitive data before encrypting files to pressure victims into paying ransoms. Attackers often leak small "proof" datasets to demonstrate their access, amplifying operational disruptions. Initial intrusions have been linked to exposed Remote Desktop Protocol (RDP) services lacking multi-factor authentication (MFA), frequently paired with stolen credentials. Once inside, Cephalus moves rapidly, disabling defenses and crippling recovery options. It uses a hybrid encryption scheme, combining AES-256 in CTR mode for file encryption with RSA-1024 to secure per-victim keys. Researchers at AttackIQ mapped Cephalus’s deployment patterns into an emulation sequence, drawing from reports by Huntress (August 2025) and AhnLab (December 2025), alongside internal analysis. The malware’s tactics, techniques, and procedures (TTPs) include: - Process injection via `VirtualAlloc` and `VirtualProtect`. - Persistence through scheduled tasks (`schtasks`). - Environment reconnaissance using Windows APIs (`GetSystemInfo`, `GetUserNameW`, `CreateToolhelp32Snapshot`). - File system enumeration with `FindFirstFileW` and `FindNextFileW`. - Defense evasion, notably tampering with Microsoft Defender disabling real-time protection, adding exclusions, and modifying registry keys via PowerShell (`Add-MpPreference`, `Set-MpPreference`). Cephalus’s rapid execution and focus on disabling security controls make it a formidable threat, particularly against organizations with unsecured RDP access or weak credential hygiene. The ransomware’s ability to bypass defenses and disrupt recovery underscores the need for proactive monitoring of high-risk entry points.