An Unerring Spear: Cephalus Ransomware Analysis

Cephalus is a newly observed, financially motivated ransomware group using Go-based malware that breaches organizations primarily via compromised RDP credentials, exfiltrates data, and performs AES-CTR encryption. The analysis describes sophisticated anti-analysis and key-protection techniques (fake AES key generation, SecureMemory with VirtualLock and XOR masking), actions to hinder recovery (deleting VSS, stopping backup services), ransom note/leak-site behavior, and includes detection signatures and sample MD5 hashes.