Cephalus Ransomware: Don’t Lose Your Head

**Executive summary:** Huntress describes two mid‑August incidents involving the Cephalus ransomware that gained initial access via compromised RDP accounts, used MEGA for probable data exfiltration, and deployed ransomware by DLL sideloading through a legitimate SentinelOne binary (SentinelBrowserNativeHost.exe) which loaded a data.bin payload; the activity included disabling Defender, deleting shadow copies, and posting ransom notes with verification links — several IOCs (file names, hashes, extensions, and paths) are provided.