Claimed
Victim claimOne-LUX listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor Claimedcephalus
Cephalus is a ransomware group active from mid-2025 that leverages stolen RDP credentials to deploy a Go-based ransomware payload via DLL sideloading, targeting law firms, healthcare, financial services, and IT firms across the US and Japan with 19 known victims.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Claimed
Victim claimShropdoc listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimShelbourne Accountants listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimDelta Information Systems listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedLast observed
Indicator2 indicators cataloged
Types: ip, onion.
Claimed
Victim claimColorado Health Network Inc listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimTexas Pregnancy Care Network listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimwilderlawfirm listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimCoCo Yachts listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimtxpregnancy.org - Fake Abortion Clinics Exposed listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimTown of Vienna, VA listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimLewis Baach Kaufmann Middlemiss PLLC listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimSherman, Silverstein, Kohl, Rose & Podolsky, P.A. listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimGuerrero Mears LLP listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimK Strategies Marketing and Public Relations listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimBAR Architects & Interiors listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimSystemExec Co., Ltd. listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimLee & Associates listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedClaimed
Victim claimLPL Financial listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedFirst listed
Victim claimCareSTL Health listed by cephalus
Actor-claimed victim evidence. This listing is not independent confirmation of compromise.
Actor ClaimedIdentity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
cephalusCanonical Name
Loading CVEs, techniques, indicators, malware, victims, and activity...