Cinnamon Tempest
Also known as:DEV-0401 · Emperor Dragonfly · BRONZE STARLIGHT
Overview
Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain.
Naming & attribution
Cinnamon Tempest is tracked under 4 names across the industry. It uses 19 documented ATT&CK techniques — more than 51% of the 174 groups tracked here. Activity attributed since at least 2021.
| Name | First reported by |
|---|---|
| DEV-0401 | Microsoft |
| Emperor Dragonfly | Biderman, O. et al |
| BRONZE STARLIGHT | SecureWorks |
Closest groups by technique overlap
Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.
- Play — 9 shared techniques (25% overlap)
- Blue Mockingbird — 8 shared techniques (24% overlap)
- Aquatic Panda China — 9 shared techniques (20% overlap)
- Earth Lusca China — 10 shared techniques (19% overlap)
- GALLIUM China — 8 shared techniques (19% overlap)
- INC Ransom — 7 shared techniques (19% overlap)
Malware families with tracked indicators
One family attributed to Cinnamon Tempest, with 323 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.
- Sliver323 indicators
Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.
Capabilities
- Exploitation of public-facing / client applications — ATT&CK T1190
- Custom malware/implant development — ATT&CK: 5 attributed custom malware families
TTPs — 19 techniques across 10 tactics
Resource Development
T1588.002Tool
Initial Access
Execution
T1047Windows Management InstrumentationT1059.001PowerShellT1059.003Windows Command ShellT1059.006Python
Persistence
T1543.003Windows Service
Stealth
T1078Valid AccountsT1078.002Domain AccountsT1140Deobfuscate/Decode Files or InformationT1574.001DLL
Defense Impairment
T1484.001Group Policy Modification
Lateral Movement
T1021.002SMB/Windows Admin SharesT1080Taint Shared Content
Command and Control
T1090ProxyT1105Ingress Tool TransferT1572Protocol Tunneling
Exfiltration
T1567.002Exfiltration to Cloud Storage
Impact
T1657Financial Theft
Tools & malware (8)
Sliver · Pandora · PlugX · Cheerscrypt · Impacket · Cobalt Strike · HUI Loader · Rclone
Reporting (3)
- How Microsoft names threat actors — Microsoft
- REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP — Biderman, O. et al
- BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER — Counter Threat Unit Research Team