Cephalus Ransomware Used SentinelOne DLL Sideloading in Two Incidents
Summary
Huntress analyzed two Cephalus ransomware incidents involving RDP access through accounts without MFA, likely data exfiltration via MEGA, and DLL sideloading through a legitimate SentinelOne executable. One deployment was stopped by Microsoft Defender.
Key points
- Huntress observed Cephalus in incidents on August 13 and 16, 2025; attackers gained access through RDP using compromised accounts without MFA.
- Attackers used MEGA in both incidents, which Huntress said was likely associated with data exfiltration.
- The ransomware was launched by SentinelBrowserNativeHost.exe loading SentinelAgentCore.dll, which then loaded data.bin; analysts could not recover data.bin.
- Before encryption, commands deleted shadow copies and attempted to weaken Microsoft Defender by adding exclusions, changing registry settings, and stopping or disabling security services.
- Microsoft Defender detected and quarantined the ransomware in one incident; it was successfully launched in the other.
- The ransom note claimed confidential data had been stolen and linked to a GoFile[.]io repository containing a sample for the victim to verify.
Article Details
- Attack Vectors
- Compromised accounts without multi-factor authentication were accessed via Remote Desktop Protocol (RDP).
- A legitimate SentinelOne executable, SentinelBrowserNativeHost.exe, was launched from the compromised user's Downloads folder to sideload SentinelAgentCore.dll, which loaded data.bin containing the ransomware code.
- MEGA was used in both incidents, likely for data exfiltration; the article describes this purpose as probable rather than confirmed.
- Defensive Notes
- Enable multi-factor authentication for accounts accessible through RDP.
- Monitor for SentinelBrowserNativeHost.exe running from a user's Downloads folder and for the associated DLL-sideloading chain involving SentinelAgentCore.dll and data.bin.
- Detect and investigate commands that delete Volume Shadow Copies, add Windows Defender exclusions, alter Defender-related registry settings, or stop and disable Defender services.
- Monitor MEGAcmd activity, including MEGAcmdUpdater.exe launched as a Scheduled Task, for potential data exfiltration.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 0d9dfc113712054d8595b50975efd9c68f4cb8960eca010076b46d2fba3d2754 | Hash of SentinelBrowserNativeHost.exe, the legitimate SentinelOne executable observed being used to sideload the ransomware DLL. |
| SHA256 | 82f5fb086d15a8079c79275c2d4a6152934e2dd61cc6a4976b492f74062773a7 | Hash of SentinelAgentCore.dll, the DLL used to load the ransomware code. |
MITRE ATT&CK
T1021.001 · Remote Desktop ProtocolAttackers used RDP via compromised accounts for initial access.T1053.005 · Scheduled TaskIn one incident, MEGAcmdUpdater.exe was launched as a Scheduled Task.T1059.001 · PowerShellPowerShell commands were used to configure Defender exclusions and stop or disable security services.T1486 · Data Encrypted for ImpactThe ransomware encrypted files and created a ransom note.T1490 · Inhibit System RecoveryThe ransomware ran vssadmin delete shadows /all /quiet to remove shadow copies and impede recovery.T1562.001 · Disable or Modify ToolsCommands added Windows Defender exclusions, changed Defender-related registry settings, and stopped or disabled Defender services.T1567.002 · Exfiltration to Cloud StorageMEGA cloud storage was used in both incidents, likely for data exfiltration.T1574.002 · DLL Side-LoadingThe ransomware was launched by sideloading SentinelAgentCore.dll through SentinelBrowserNativeHost.exe.
People
Malware
Vendors
MicrosoftWhile in both incidents the attackers attempted to deploy the ransomware, one of the deployments failed thanks to Microsoft Defender detecting and quarantining the file.SentinelOnethe ransomware itself, which involved sideloading a dynamic link library (DLL) via a legitimate SentinelOne executable file (SentinelBrowserNativeHost.exe), and then loading a data.bin file via the DLL that
Products
MEGAWe also saw attackers use the MEGA cloud storage platform, presumably for data exfiltration.Microsoft Defender Antimalware PlatformWhile in both incidents the attackers attempted to deploy the ransomware, one of the deployments failed thanks to Microsoft Defender detecting and quarantining the file.SentinelAgentCore.dllSentinelBrowserNativeHost.exe, a legitimate SentinelOne executable, was launched from the user’s Downloads folder, which then loaded SentinelAgentCore.dll.SentinelBrowserNativeHost.exesideloading a dynamic link library (DLL) via a legitimate SentinelOne executable file (SentinelBrowserNativeHost.exe), and then loading a data.bin file via the DLL that contains the actual ransomware code.