Threat Actors Cinnamon Tempest

Cinnamon Tempest

G1021 TLP:CLEAR

Active

Kill Chain Analysis Generate Graph Hunt Package

Also known as: DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT, SLIME34, Cinnamon Tempest

Description

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Trend Micro Cheerscrypt May 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)

AI Analysis

· 2 months ago

Executive Summary

Cinnamon Tempest is a China-based threat group active since 2021, deploying ransomware strains based on the Babuk source code with potential motivations beyond financial gain, possibly including intellectual property theft or cyberespionage. The group operates independently in all stages of the attack lifecycle and has been linked to malware used by government-sponsored threat groups. Their activities pose significant challenges for defense due to their agility and adaptability.

Enhanced Description

The implications of Cinnamon Tempest's operations extend beyond the immediate consequences of ransomware attacks, touching on broader issues of cybersecurity, national security, and international relations. As the world becomes increasingly interconnected, the distinctions between state-sponsored and criminal cyber activities continue to blur, complicating efforts to attribute and respond to cyber threats. The response to Cinnamon Tempest and similar threat actors must therefore be multifaceted, combining technical defenses with strategic communications and diplomacy to address the root causes and secondary effects of these cyber campaigns. Only through comprehensive and collaborative efforts can the international community hope to mitigate the risks posed by sophisticated cyber threat actors like Cinnamon Tempest.

Key Capabilities

Deployment of customized ransomware strains
Independence in all stages of the attack lifecycle
Potential for intellectual property theft or cyberespionage
Use of malware attributed to government-sponsored threat groups
Rapid development and deployment of new ransomware variants

MITRE ATT&CK Tactics

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Recommended Actions

Implement robust network defenses, including intrusion detection and prevention systems
Conduct regular security audits and vulnerability assessments
Develop and enforce robust backup and disaster recovery policies
Educate users about the risks of ransomware and the importance of security best practices
Monitor for indicators of compromise associated with Cinnamon Tempest and similar threat actors

Suggested Tags

APT

Ransomware

Espionage

Finance-Sector

China-Based Threat Actor

Confidence Assessment

The confidence level in the available data on Cinnamon Tempest is moderate, based on reports from reputable cybersecurity sources. However, information gaps exist regarding the group's primary motivation, targeted sectors, and countries, as well as the exact nature of its relationship to Chinese government interests. Further research and intelligence gathering are necessary to fully understand the scope and impact of this threat actor.

ATT&CK Techniques

Command & Control

3 techniques

T1090

Proxy

Cinnamon Tempest has used a customized version of the Iox port-forwarding and proxy tool.(Citation: Sygnia Emperor Dragonfly October 2022)

T1105

Ingress Tool Transfer

Cinnamon Tempest has downloaded files, including Cobalt Strike, to compromised hosts.(Citation: Sygnia Emperor Dragonfly October 2022)

T1572

Protocol Tunneling

Cinnamon Tempest has used the Iox and NPS proxy and tunneling tools in combination create multiple connections through a single tunnel.(Citation: Sygnia Emperor Dragonfly October 2022)

Defense impairment

1 technique

T1484.001

Group Policy Modification

Cinnamon Tempest has used Group Policy to deploy batch scripts for ransomware deployment.(Citation: Microsoft Ransomware as a Service)

Execution

4 techniques

T1047

Windows Management Instrumentation

Cinnamon Tempest has used Impacket for lateral movement via WMI.(Citation: Microsoft Ransomware as a Service)(Citation: Sygnia Emperor Dragonfly October 2022)

T1059.001

PowerShell

Cinnamon Tempest has used PowerShell to communicate with C2, download files, and execute reconnaissance commands.(Citation: Sygnia Emperor Dragonfly October 2022)

T1059.003

Windows Command Shell

Cinnamon Tempest has executed ransomware using batch scripts deployed via GPO.(Citation: Microsoft Ransomware as a Service)

T1059.006

Python

Cinnamon Tempest has used a customized version of the Impacket wmiexec.py module to create renamed output files.(Citation: Microsoft Ransomware as a Service)

Exfiltration

1 technique

T1567.002

Exfiltration to Cloud Storage

Cinnamon Tempest has uploaded captured keystroke logs to the Alibaba Cloud Object Storage Service, Aliyun OSS.(Citation: Sygnia Emperor Dragonfly October 2022)

Impact

1 technique

T1657

Financial Theft

Cinnamon Tempest has maintained leak sites for exfiltrated data in attempt to extort victims into paying a ransom.(Citation: Microsoft Ransomware as a Service)

Initial Access

1 technique

T1190

Exploit Public-Facing Application

Cinnamon Tempest has exploited multiple unpatched vulnerabilities for initial access including vulnerabilities in Microsoft Exchange, Manage Engine AdSelfService Plus, Confluence, and Log4j.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Log4j Vulnerability Exploitation December 2021)(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)

Lateral Movement

2 techniques

T1021.002

SMB/Windows Admin Shares

Cinnamon Tempest has used SMBexec for lateral movement.(Citation: Sygnia Emperor Dragonfly October 2022)

T1080

Taint Shared Content

Cinnamon Tempest has deployed ransomware from a batch file in a network share.(Citation: Microsoft Ransomware as a Service)

Persistence

1 technique

T1543.003

Windows Service

Cinnamon Tempest has created system services to establish persistence for deployed tooling.(Citation: Sygnia Emperor Dragonfly October 2022)

Resource Development

1 technique

T1588.002

Tool

Cinnamon Tempest has used open-source tools including customized versions of the Iox proxy tool, NPS tunneling tool, Meterpreter, and a keylogger that uploads data to Alibaba cloud storage.(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)

Stealth

4 techniques

T1078

Valid Accounts

Cinnamon Tempest has used compromised user accounts to deploy payloads and create system services.(Citation: Sygnia Emperor Dragonfly October 2022)

T1078.002

Domain Accounts

Cinnamon Tempest has obtained highly privileged credentials such as domain administrator in order to deploy malware.(Citation: Microsoft Ransomware as a Service)

T1140

Deobfuscate/Decode Files or Information

Cinnamon Tempest has used weaponized DLLs to load and decrypt payloads.(Citation: Sygnia Emperor Dragonfly October 2022)

T1574.001

DLL

Cinnamon Tempest has used search order hijacking to launch Cobalt Strike Beacons.(Citation: Microsoft Ransomware as a Service)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022) Cinnamon Tempest has also abused legitimate executables to side-load weaponized DLLs.(Citation: Sygnia Emperor Dragonfly October 2022)

Software / Tooling

S1096

Cheerscrypt

Family

(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: Trend Micro Cheerscrypt May 2022)

S0154

Cobalt Strike

Family

(Citation: Microsoft Ransomware as a Service)(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)

S0154

Cobalt Strike - S0154

Family

(Citation: Microsoft Ransomware as a Service)(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)

S1097

HUI Loader

Family

(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)

S0664

Pandora

Family

(Citation: Microsoft Ransomware as a Service)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)(Citation: Sygnia Emperor Dragonfly October 2022)(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)

S0013

PlugX

Family

(Citation: Dell SecureWorks BRONZE STARLIGHT Profile)

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

Sygnia Emperor Dragonfly October 2022 — Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023.
SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 — Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023.
Trend Micro Cheerscrypt May 2022 — Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023.
Microsoft Threat Actor Naming July 2023 — Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023.
Microsoft Ransomware as a Service — Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023.
Dell SecureWorks BRONZE STARLIGHT Profile — SecureWorks. (n.d.). BRONZE STARLIGHT. Retrieved December 6, 2023.

Intel Summary

Techniques

Tools

Campaigns

IOCs

Observed Data

Tactics

Details

MITRE ID: G1021
Type: Unknown
Country of Origin: C
Confidence: 90%
Added: May 2, 2026
STIX ID: intrusion-set--8b1e16f6-e7c8-4b7a-a5df-f81232c13e2f

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.