Back Scworld

Hacked RDP credentials facilitate Cephalus ransomware delivery

Scworld • November 10, 2025

Newly emergent Cephalus ransomware operation has been leveraging stolen Remote Desktop Protocol credentials to facilitate compromise, GBHackers News reports.

Hacked credentials from RDP accounts without multi-factor authentication were leveraged by Cephalus to infiltrate targeted organizations' networks and launch custom malware tailored to their victims for maximum success, according to an analysis from the AhnLab Security Intelligence Center. Execution of the Go-based Cephalus ransomware not only immediately deactivates Windows Defender, Microsoft SQL Server databases, and Veeam backup software, but also erases Volume Shadow Copy Service backups to make data recovery more challenging.

Cephalus also conceals the lone key it uses for AES-CTR encryption by generating bogus keys during execution, adopting a SecureMemory structure for key storage management, and harnessing Windows API functions for in-memory key locking, as well as including a random value for XOR before storage. Further analysis is needed to establish the Cephalus group's possible connections with other ransomware operations.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Lynx Ransomware Deployed via Compromised RDP After Backup Deletion Threat actors are exploiting compromised Remote Desktop Protocol (RDP) logins to deploy Lynx ransomware. The attackers are deleting server backups to maximize the impact of the ransomware, affecting organizations that rely on these backups for recovery. This tactic highlights the increasing sophistication of ransomware attacks in the cybersecurity landscape. 5 sources 37

Extracted Entities

Hacked RDP credentials facilitate Cephalus ransomware delivery

The full story

Extracted Entities

Attack Types (1)

Platforms (5)

Ransomware Groups (1)