Cinnamon Tempest

Introduction

Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, Cinnamon Tempest may be motivated by intellectual property theft or cyberespionage rather than financial gain. Microsoft Ransomware as a Service Microsoft Threat Actor Naming July 2023 Trend Micro Cheerscrypt May 2022 SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022

Activities and Tactics

Country of Origin: 🇨🇳 China

Notable Campaigns

Information pending cataloguing.

Tactics, Techniques, and Procedures (TTPs)

• T1047 Windows Management Instrumentation
• T1574.001 DLL
• T1105 Ingress Tool Transfer
• T1484.001 Group Policy Modification
• T1567.002 Exfiltration to Cloud Storage
• T1588.002 Tool
• T1078 Valid Accounts
• T1657 Financial Theft
• T1090 Proxy
• T1078.002 Domain Accounts
• T1190 Exploit Public-Facing Application
• T1059.006 Python
• T1140 Deobfuscate/Decode Files or Information
• T1021.002 SMB/Windows Admin Shares
• T1572 Protocol Tunneling
• T1080 Taint Shared Content
• T1543.003 Windows Service
• T1059.001 PowerShell
• T1059.003 Windows Command Shell

ATT&CK technique IDs (denormalized)

• T1021.002
• T1047
• T1059.001
• T1059.003
• T1059.006
• T1078
• T1078.002
• T1080
• T1090
• T1105
• T1140
• T1190
• T1484.001
• T1543.003
• T1567.002
• T1572
• T1574.001
• T1588.002
• T1657

Notable Indicators of Compromise (IOCs)

No curated IOCs are currently published for this actor. This section will be updated when stable, attributable indicators are available.

Malware and Tools

MITRE ATT&CK Software

• Sliver (S0633) — tool
• Pandora (S0664) — malware
• PlugX (S0013) — malware
• Cheerscrypt (S1096) — malware
• Impacket (S0357) — tool
• Cobalt Strike (S0154) — malware
• HUI Loader (S1097) — malware
• Rclone (S1040) — tool

Attribution and Evidence

Country of Origin: China Additional attribution information pending cataloguing.

References

[1] mitre-attack [5] Sygnia Emperor Dragonfly October 2022 Biderman, O. et al. (2022, October 3). REVEALING EMPEROR DRAGONFLY: NIGHT SKY AND CHEERSCRYPT - A SINGLE RANSOMWARE GROUP. Retrieved December 6, 2023. [6] SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 Counter Threat Unit Research Team . (2022, June 23). BRONZE STARLIGHT RANSOMWARE OPERATIONS USE HUI LOADER. Retrieved December 7, 2023. [7] Trend Micro Cheerscrypt May 2022 Dela Cruz, A. et al. (2022, May 25). New Linux-Based Ransomware Cheerscrypt Targeting ESXi Devices Linked to Leaked Babuk Source Code. Retrieved December 19, 2023. [8] Microsoft Threat Actor Naming July 2023 Microsoft . (2023, July 12). How Microsoft names threat actors. Retrieved November 17, 2023. [9] Microsoft Ransomware as a Service Microsoft. (2022, May 9). Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself. Retrieved March 10, 2023. [10] Dell SecureWorks BRONZE STARLIGHT Profile SecureWorks. (n.d.). BRONZE STARLIGHT. Retrieved December 6, 2023.