🏹 cephalus — Ransomware
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Classification
Ransomware
Leak-site victims
19
Ransomware.live
Associated IoCs
0
local intel
MITRE techniques
—
ATT&CK
Tracked
Yes
Ransomware.live
🔥 Leak-Site Victims (19)
| Victim | Country | Published | Domain |
|---|---|---|---|
| One-LUX | GB | 2025-08-29T03:21:19.126983+00:00 | one-lux.com |
| Shropdoc | GB | 2025-08-29T03:20:54.154382+00:00 | shropdoc.org.uk |
| Shelbourne Accountants | IE | 2025-08-29T03:20:29.137532+00:00 | shelbourneaccountants.ie |
| Delta Information Systems | US | 2025-08-29T03:20:04.796498+00:00 | acroamatics.com |
| Colorado Health Network Inc | US | 2025-08-28T07:09:07.168732+00:00 | coloradohealthnetwork.org |
| Texas Pregnancy Care Network | US | 2025-08-28T02:40:01.124485+00:00 | texaspregnancy.org |
| wilderlawfirm | US | 2025-08-28T02:39:36.819468+00:00 | wilderlawfirm.com |
| CoCo Yachts | NL | 2025-08-28T02:39:08.861217+00:00 | www.cocoyachts.com |
| txpregnancy.org - Fake Abortion Clinics Exposed | US | 2025-08-26T15:03:10.616825+00:00 | txpregnancy.org |
| Town of Vienna, VA | US | 2025-08-26T15:03:02.808420+00:00 | viennava.gov |
| Lewis Baach Kaufmann Middlemiss PLLC | US | 2025-08-26T14:59:00.083442+00:00 | lbkmlaw.com |
| Sherman, Silverstein, Kohl, Rose & Podolsky, P.A. | US | 2025-08-26T14:58:21.814773+00:00 | sskrplaw.com |
| Guerrero Mears LLP | US | 2025-08-26T14:57:42.406100+00:00 | gmllp.com |
| K Strategies Marketing and Public Relations | US | 2025-08-26T14:53:07.998134+00:00 | kstrategies.com |
| BAR Architects & Interiors | 2025-08-26T14:52:33.008897+00:00 | bararch.com | |
| SystemExec Co., Ltd. | JP | 2025-08-26T14:44:13.444706+00:00 | system-exe.co.jp |
| Lee & Associates | US | 2025-08-26T14:58:36.183295+00:00 | lee-irvine.com |
| LPL Financial | US | 2025-08-26T14:53:45.678482+00:00 | balancedsolutions4me.com |
| CareSTL Health | US | 2025-08-26T14:43:37.199191+00:00 | carestlhealth.org |
Source: Ransomware.live leak-site monitoring (cached, offline-safe).
📁 Case Management
🏹 Campaigns & malware
🏹 Add to case
🧩 Advanced Capabilities
Live group profile & victims via Ransomware.live; ATT&CK technique hints are a static reference for well-known groups. All network calls cached & offline-safe.
Workstation · Copilot · AI Skills · Automation · Playbooks · Lookups · Docs · Reports
🤖 AI Copilot
⚡ AI Skills
🔍 Lookup & Enrich
📚 Docs & Reports
💡 Recommendations
- Explore related tools below
- Automate recurring work via cron