MITRE ATT&CKgroup

G1021 Cinnamon Tempest

Published 2023-12-06 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT
Version
1.0
Created
2023-12-06

Description

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.

Related

Uses · MITRE ATT&CK (27)

  • S1097 HUI Loader software (malware)
  • S1096 Cheerscrypt software (malware)
  • T1657 Financial Theft technique
  • S1040 Rclone software (tool)
  • S0664 Pandora software (malware)
  • S0633 Sliver software (tool)
  • T1484.001 Group Policy Modification sub-technique
  • T1588.002 Tool sub-technique
  • T1572 Protocol Tunneling technique
  • T1078.002 Domain Accounts sub-technique
  • T1574.001 DLL sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1059.006 Python sub-technique
  • T1567.002 Exfiltration to Cloud Storage sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1543.003 Windows Service sub-technique
  • S0357 Impacket software (tool)
  • T1190 Exploit Public-Facing Application technique
  • S0154 Cobalt Strike software (malware)
  • T1140 Deobfuscate/Decode Files or Information technique
  • S0013 PlugX software (malware)
  • T1047 Windows Management Instrumentation technique
  • T1078 Valid Accounts technique
  • T1080 Taint Shared Content technique
  • T1090 Proxy technique
  • T1105 Ingress Tool Transfer technique

References