Full Report
In mid-August, Huntress saw two incidents that linked back to a ransomware variant called Cephalus, which included DLL sideloading via a legitimate SentinelOne executable.
Analysis Summary
# Incident Report: Cephalus Ransomware Deployment via DLL Sideloading
## Executive Summary
In mid-August 2025, Huntress identified two separate ransomware incidents involving a new variant called "Cephalus." The attackers leveraged compromised RDP accounts without MFA for initial access and utilized a sophisticated DLL sideloading technique involving a legitimate SentinelOne executable to deploy the final payload. While data exfiltration was attempted via MEGA, one deployment was successfully mitigated by automated security controls.
## Incident Details
- **Discovery Date:** August 13, 2025
- **Incident Date:** August 13 – August 16, 2025
- **Affected Organization:** Two undisclosed organizations
- **Sector:** Not disclosed
- **Geography:** Not disclosed
## Timeline of Events
### Initial Access
- **Date/Time:** Mid-August 2025
- **Vector:** Remote Desktop Protocol (RDP)
- **Details:** Attackers gained access to the environment by leveraging compromised user credentials. The accounts targeted did not have Multi-Factor Authentication (MFA) enabled.
### Lateral Movement
- **Details:** The report indicates the ransomware was likely not deployed "over the network" via shares, but rather executed directly on the endpoints after initial access was established.
### Data Exfiltration/Impact
- **Details:** Attackers were observed using the **MEGA** cloud storage platform, presumably to exfiltrate sensitive corporate data prior to encryption.
### Detection & Response
- **Discovery:** Detection occurred during the ransomware deployment phase.
- **Response actions:** In one instance, **Microsoft Defender** detected and quarantined the malicious files, preventing the encryption process. Huntress SOC analysts investigated the use of legitimate binaries for sideloading.
## Attack Methodology
- **Initial Access:** Valid Accounts (RDP)
- **Persistence:** Not explicitly detailed, though RDP access was maintained throughout the session.
- **Privilege Escalation:** Not specified; likely relied on the privileges of the compromised RDP accounts.
- **Defense Evasion:** DLL Sideloading. Attackers placed a legitimate, signed executable (`SentinelBrowserNativeHost.exe`) in the Downloads folder to load a malicious DLL (`SentinelAgentCore.dll`).
- **Credential Access:** Likely obtained via prior credential harvesting or brute force (due to lack of MFA).
- **Discovery:** Local system discovery via manual RDP interaction.
- **Lateral Movement:** Limited; focus appeared to be on local execution.
- **Collection:** Gathering files for exfiltration to MEGA.
- **Exfiltration:** Exfiltration to Cloud Storage (MEGA).
- **Impact:** Data Encrypted for Impact (Cephalus Ransomware).
## Impact Assessment
- **Financial:** Not disclosed; potential ransom demands following Cephalus encryption.
- **Data Breach:** Attempted exfiltration via MEGA; volume of data not specified.
- **Operational:** One organization suffered successful encryption; the other was mitigated by AV.
- **Reputational:** Potential impact associated with ransomware disclosure.
## Indicators of Compromise
- **File Indicators:**
- `SentinelBrowserNativeHost.exe` (Legitimate binary used as a proxy)
- `SentinelAgentCore.dll` (Malicious loader)
- `data.bin` (Encrypted ransomware payload)
- **Behavioral Indicators:**
- Execution of legitimate security binaries from unusual paths (e.g., `\Downloads\`).
- Outbound traffic to `mega[.]nz` from unauthorized accounts.
## Response Actions
- **Containment:** Quarantine of malicious files by Microsoft Defender.
- **Eradication:** Removal of the `data.bin` and malicious DLL from the affected user profiles.
- **Recovery:** Restoration of files from backups (in the successful encryption case) and password resets for compromised accounts.
## Lessons Learned
- **Exploitation of Trust:** Attackers are increasingly using "Bring Your Own Vulnerable Binary" or sideloading techniques using trusted, signed tools (like SentinelOne components) to bypass EDR/AV detections.
- **MFA is Critical:** The lack of MFA on RDP remains the primary entry point for these ransomware groups.
## Recommendations
- **Enforce MFA:** Implement Multi-Factor Authentication on all external-facing services, especially RDP and VPNs.
- **Path Restrictions:** Block the execution of executables from user-writable directories like `Downloads` or `AppData` using AppLocker or Software Restriction Policies (SRP).
- **Monitoring:** Monitor for legitimate security software binaries running from non-standard installation paths.
- **Cloud Egress Filtering:** Restrict or alert on high-volume data transfers to known cloud storage providers like MEGA.