cephalus
Activity analysis
HackerFeeds has tracked 19 victims claimed by cephalus since June 2025, most recently in August 2025 — ranking #174 of 332 groups (0.1% of all tracked ransomware victims). No new victims have been posted in the last 180 days; the most recent claim was in August 2025. Its most-targeted sector is Business Services (5 victims), followed by Healthcare (4). The United States accounts for 13 victims (72% of those with a known location); 1 victims did not disclose a location.
Victims per year
- 202519
Top sectors
- Business Services5
- Healthcare4
- Technology2
- Financial Services2
- Public Sector1
- Manufacturing1
Top countries
Computed from victims claimed on the group's leak site as collected by HackerFeeds; claims are not independently verified. Monthly reports · Methodology
Group profile
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Recent victims
No victims tracked yet.