Cephalus Ransomware Emerges as Go-Based Double-Extortion Threat Exploiting Exposed RDP Access

Cephalus is a Go-based ransomware campaign active since mid-2025 that leverages exposed RDP and stolen credentials for initial access, uses process injection and anti-analysis techniques, encrypts files with AES-256 CTR and protects keys with RSA-1024, and conducts data exfiltration to cloud services (e.g., MEGA) followed by public leak-site extortion; it also disables Defender, deletes Volume Shadow Copies, and terminates backup/database services to maximize impact, with guidance recommending removal of public RDP, enforcing MFA, and verifying backups.