// THREAT ACTOR
CEPHALUS_
DormantCEPHALUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem — file encryption combined with the threat of stolen-data publication on a public leak site — and continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CEPHALUS — incident write-ups, attribution notes, and additional context — see the Threat Groups archive or run a site search.
Victims by year
- 2025 26
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs — links are deliberately not provided.
-
cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onionCephalus snapshot · 2025-08-29 09:14
Recent victims
The 50 most recent victims claimed by CEPHALUS. Total in the index: 26.
| Date listed | Victim | Description |
|---|---|---|
| 2025-08-29 | One-LUX | one-lux.com > coming soon |
| 2025-08-29 | Shropdoc | shropdoc.org.uk > coming soon |
| 2025-08-29 | Shelbourne Accountants | shelbourneaccountants.ie > coming soon... |
| 2025-08-29 | Delta Information Systems | acroamatics.com > We have got all the software and hardware code,and g… |
| 2025-08-28 | Colorado Health Network Inc | coloradohealthnetwork.org > 900G+ data coming soon |
| 2025-08-28 | Texas Pregnancy Care Network | texaspregnancy.org > coming soon |
| 2025-08-28 | wilderlawfirm | wilderlawfirm.com > coming soon |
| 2025-08-28 | CoCo Yachts | www.cocoyachts.com > We got a total of 1.8TB+ of data,including projec… |
| 2025-08-26 | txpregnancy.org - Fake Abortion Clinics Exposed | txpregnancy.org > coming soon |
| 2025-08-26 | Lee & Associates | lee-irvine.com > Lee & Associates DATA LEAK | (TB) |
| 2025-08-26 | Sherman, Silverstein, Kohl, Rose & Podolsky, P.A. | sskrplaw.com > SSKRPLAW DATA LEAK | (5GB+ ZIP) |
| 2025-08-26 | Guerrero Mears LLP | gmllp.com > Guerrero Mears LLP DATALEAK | (FORGOT THE SIZE) |
| 2025-08-26 | LPL Financial | balancedsolutions4me.com > LPL Financial DATA LEAK | (I FORGOT THE SIZ… |
| 2025-08-26 | K Strategies Marketing and Public Relations | kstrategies.com > K Strategies Marketing and Public Relations LEAK | 9… |
| 2025-08-26 | BAR Architects & Interiors | bararch.com > BAR Architects & Interiors DATA LEAK | 1.5T+ |
| 2025-08-26 | SystemExec Co., Ltd. | system-exe.co.jp > SystemExec Co., Ltd. (システムエグゼ) GitLab naked repo le… |
| 2025-08-26 | CareSTL Health | carestlhealth.org > CareSTL Health DATA Leak | 500+GB | KAWA4096 STEAL… |
| 2025-08-26 | txpregnancy.org | > coming soon |
| 2025-08-26 | lee-irvine.com | > Lee & Associates DATA LEAK | (TB) |
| 2025-08-26 | sskrplaw.com | > SSKRPLAW DATA LEAK | (5GB+ ZIP) |
| 2025-08-26 | gmllp.com | > Guerrero Mears LLP DATALEAK | (FORGOT THE SIZE) |
| 2025-08-26 | balancedsolutions4me.com | > LPL Financial DATA LEAK | (I FORGOT THE SIZE,BUT ITS HUGE) |
| 2025-08-26 | kstrategies.com | > K Strategies Marketing and Public Relations LEAK | 900+GB |
| 2025-08-26 | bararch.com | > BAR Architects & Interiors DATA LEAK | 1.5T+ |
| 2025-08-26 | system-exe.co.jp | > SystemExec Co., Ltd. (システムエグゼ) GitLab naked repo leak | 30G+ |
| 2025-08-26 | carestlhealth.org | > CareSTL Health DATA Leak | 500+GB | KAWA4096 STEALED our data |