Cephalus Ransomware Sideloading via SentinelOne Executable

Georg Lauenstein@gsec

•updated Nov 11, 2025•3•0•79

Detects potential DLL sideloading activity associated with Cephalus ransomware, where a legitimate SentinelOne executable is launched from a non-standard path and loads a malicious DLL.