Cephalus Ransomware Exploits Exposed RDP in Double-Extortion Attacks

Back Cyberpress

Cephalus Ransomware Exploits Exposed RDP in Double-Extortion Attacks

Cyberpress • February 11, 2026

Share: View original

Cephalus ransomware has emerged as a potent threat since mid-2025, targeting Windows systems through vulnerable Remote.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Cephalus Ransomware Targets Windows via Exposed RDP in Double-Extortion Scheme Cephalus ransomware has been actively exploiting exposed Remote Desktop Protocol (RDP) vulnerabilities since mid-2025, primarily targeting Windows systems. The attacks utilize a double-extortion tactic, where victims are not only encrypted but also threatened with data leaks unless a ransom is paid. 1 sources 38

Extracted Entities

Attack Types (1)

MITRE ATT&CK (1)

T1021.001 - Remote Desktop Protocol

Platforms (1)

Ransomware Groups (1)