THREAT ACTOR
CEPHALUS_
DormantCEPHALUS is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of CEPHALUS, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2025 26
Leak site mirrors
1 mirror tracked, 0 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
cephalus6oiypuwumqlwurvbmwsfglg424zjdmywfgqm4iehkqivsjyd.onionCephalus snapshot · 2025-08-29 09:14
Recent victims
The 50 most recent victims claimed by CEPHALUS. Total in the index: 26.
| Date listed | Victim | Description |
|---|---|---|
| 2025-08-29 | One-LUX | one-lux.com > coming soon |
| 2025-08-29 | Shropdoc | shropdoc.org.uk > coming soon |
| 2025-08-29 | Shelbourne Accountants | shelbourneaccountants.ie > coming soon... |
| 2025-08-29 | Delta Information Systems | acroamatics.com > We have got all the software and hardware code,and g… |
| 2025-08-28 | Colorado Health Network Inc | coloradohealthnetwork.org > 900G+ data coming soon |
| 2025-08-28 | Texas Pregnancy Care Network | texaspregnancy.org > coming soon |
| 2025-08-28 | wilderlawfirm | wilderlawfirm.com > coming soon |
| 2025-08-28 | CoCo Yachts | www.cocoyachts.com > We got a total of 1.8TB+ of data,including projec… |
| 2025-08-26 | txpregnancy.org - Fake Abortion Clinics Exposed | txpregnancy.org > coming soon |
| 2025-08-26 | Lee & Associates | lee-irvine.com > Lee & Associates DATA LEAK | (TB) |
| 2025-08-26 | Sherman, Silverstein, Kohl, Rose & Podolsky, P.A. | sskrplaw.com > SSKRPLAW DATA LEAK | (5GB+ ZIP) |
| 2025-08-26 | Guerrero Mears LLP | gmllp.com > Guerrero Mears LLP DATALEAK | (FORGOT THE SIZE) |
| 2025-08-26 | LPL Financial | balancedsolutions4me.com > LPL Financial DATA LEAK | (I FORGOT THE SIZ… |
| 2025-08-26 | K Strategies Marketing and Public Relations | kstrategies.com > K Strategies Marketing and Public Relations LEAK | 9… |
| 2025-08-26 | BAR Architects & Interiors | bararch.com > BAR Architects & Interiors DATA LEAK | 1.5T+ |
| 2025-08-26 | SystemExec Co., Ltd. | system-exe.co.jp > SystemExec Co., Ltd. (システムエグゼ) GitLab naked repo le… |
| 2025-08-26 | CareSTL Health | carestlhealth.org > CareSTL Health DATA Leak | 500+GB | KAWA4096 STEAL… |
| 2025-08-26 | txpregnancy.org | > coming soon |
| 2025-08-26 | lee-irvine.com | > Lee & Associates DATA LEAK | (TB) |
| 2025-08-26 | sskrplaw.com | > SSKRPLAW DATA LEAK | (5GB+ ZIP) |
| 2025-08-26 | gmllp.com | > Guerrero Mears LLP DATALEAK | (FORGOT THE SIZE) |
| 2025-08-26 | balancedsolutions4me.com | > LPL Financial DATA LEAK | (I FORGOT THE SIZE,BUT ITS HUGE) |
| 2025-08-26 | kstrategies.com | > K Strategies Marketing and Public Relations LEAK | 900+GB |
| 2025-08-26 | bararch.com | > BAR Architects & Interiors DATA LEAK | 1.5T+ |
| 2025-08-26 | system-exe.co.jp | > SystemExec Co., Ltd. (システムエグゼ) GitLab naked repo leak | 30G+ |
| 2025-08-26 | carestlhealth.org | > CareSTL Health DATA Leak | 500+GB | KAWA4096 STEALED our data |
CONFIRMED ATTACKS
Cephalus confirmed attacks: 4 verified incidents
Ransomnews has verified 4 Cephalus incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from June 2025 to August 2025. United States accounts for 3 of them (75%), with victims recorded in 2 countries in total. The most affected sector is healthcare, at 1 confirmed victim. Where a figure was disclosed (3 cases), these incidents account for 70,596 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Cephalus incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| August 2025 | Town of Vienna | Government | Virginia, United States | 811 | Unknown | Source |
| July 2025 | Colorado Health Network Inc. | Healthcare | Colorado, United States | 68,212 | Unknown | Source |
| July 2025 | Money Matters | Finance | Florida, United States | 1,573 | Unknown | Source |
| June 2025 | SystemEXE, Inc. | Technology | Tokyo, Japan | — | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Cephalus's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.