S1096 Cheerscrypt

malwareEnterprise

platformsWindows · ESXi

also known asCheerscrypt

Cheerscrypt is a ransomware that was developed by Cinnamon Tempest and has been used in attacks against ESXi and Windows environments since at least 2022. Cheerscrypt was derived from the leaked Babuk source code and has infrastructure overlaps with deployments of Night Sky ransomware, which was also derived from Babuk.

techniques used (5)

ATT&CK techniques this enables or maps to.

T1059.012Hypervisor CLI
T1083File and Directory Discovery
T1486Data Encrypted for Impact
T1489Service Stop
T1673Virtual Machine Discovery

used by groups (1)

Threat groups associated with this.

G1021Cinnamon Tempest

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan