New Ransomware Group Cephalus Emerges with Sophisticated Go-Based Attacks
Cyber Security News by CyberSum.net
Researchers have identified a new ransomware group named Cephalus, which surfaced in mid-June 2025. The group uses custom-built Go-based ransomware and sophisticated anti-analysis mechanisms. They target organizations by brute-forcing or purchasing compromised RDP credentials without MFA. Cephalus exfiltrates sensitive data before encryption and maintains a dedicated leak site on the dark web. The ransomware includes mechanisms to thwart dynamic analysis and forensic recovery, such as creating fake AES keys and using a custom SecureMemory structure to manage encryption keys.