Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.1234
- Microsoft Ransomware as a Service
- Microsoft Threat Actor Naming July 2023
- Trend Micro Cheerscrypt May 2022
- SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1021.002 | SMB/Windows Admin Shares | — |
| T1047 | Windows Management Instrumentation | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.006 | Python | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1080 | Taint Shared Content | — |
| T1090 | Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1484.001 | Group Policy Modification | — |
| T1543.003 | Windows Service | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1572 | Protocol Tunneling | — |
| T1574.001 | DLL | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
Aliases
BRONZE STARLIGHT · Cinnamon Tempest · DEV-0401 · Emperor Dragonfly
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.