G1021 Cinnamon Tempest
Enterprisealso known asCinnamon Tempest · DEV-0401 · Emperor Dragonfly · BRONZE STARLIGHT
Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.
canonical actor
The group this is attributed to.
techniques used (19)
ATT&CK techniques this enables or maps to.
software used (8)
Malware and tools associated with this.
source
Where this definition is published.