Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.1234
- Microsoft Ransomware as a Service
- Microsoft Threat Actor Naming July 2023
- Trend Micro Cheerscrypt May 2022
- SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| also_known_as | Cinnamon Tempest | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | DEV-0401 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Emperor Dragonfly | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | BRONZE STARLIGHT | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1484.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1080 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1021.002 | SMB/Windows Admin Shares | — |
| T1047 | Windows Management Instrumentation | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.006 | Python | — |
| T1078 | Valid Accounts | — |
| T1078.002 | Domain Accounts | — |
| T1080 | Taint Shared Content | — |
| T1090 | Proxy | — |
| T1105 | Ingress Tool Transfer | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1484.001 | Group Policy Modification | — |
| T1543.003 | Windows Service | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1572 | Protocol Tunneling | — |
| T1574.001 | DLL | — |
| T1588.002 | Tool | — |
| T1657 | Financial Theft | — |
别名
BRONZE STARLIGHT · Cinnamon Tempest · DEV-0401 · Emperor Dragonfly
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。