CVE Intelligence
Home / Threat actors / Cinnamon Tempest

Cinnamon Tempest G1021

🔔 Create alert

Also known as: DEV-0401, Emperor Dragonfly, BRONZE STARLIGHT

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
28
Techniques
8
Malware and tools

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.

Ransomware operations linked to this group ransomware.live

pandora via Pandora

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development
T1588.002 Tool
Initial Access
T1078 Valid AccountsT1078.002 Domain AccountsT1190 Exploit Public-Facing Application
Execution
T1047 Windows Management InstrumentationT1059.001 PowerShellT1059.003 Windows Command ShellT1059.006 PythonT1574.001 DLL
Persistence
T1078 Valid AccountsT1078.002 Domain AccountsT1543.003 Windows Service
Privilege Escalation
T1078 Valid AccountsT1078.002 Domain AccountsT1484.001 Group Policy ModificationT1543.003 Windows Service
Stealth
T1078 Valid AccountsT1078.002 Domain AccountsT1140 Deobfuscate/Decode Files or InformationT1574.001 DLL
Defense Impairment
T1484.001 Group Policy Modification
Lateral Movement
T1021.002 SMB/Windows Admin SharesT1080 Taint Shared Content
Command and Control
T1090 ProxyT1105 Ingress Tool TransferT1572 Protocol Tunneling
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Impact
T1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.