Cinnamon Tempest
MITREUnknown
Unknown
Unknown
[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) may be motivated by intellectual property theft or cyberespionage rather than financial gain.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Trend Micro Cheerscrypt May 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)
Tecniche Utilizzate (19)
| ID | ATT&CK | Tattiche |
|---|---|---|
| T1021.002 | SMB/Windows Admin Shares | - |
| T1047 | Windows Management Instrumentation | - |
| T1059.001 | PowerShell | - |
| T1059.003 | Windows Command Shell | - |
| T1059.006 | Python | - |
| T1078 | Valid Accounts | - |
| T1078.002 | Domain Accounts | - |
| T1080 | Taint Shared Content | - |
| T1090 | Proxy | - |
| T1105 | Ingress Tool Transfer | - |
| T1140 | Deobfuscate/Decode Files or Information | - |
| T1190 | Exploit Public-Facing Application | - |
| T1484.001 | Group Policy Modification | - |
| T1543.003 | Windows Service | - |
| T1567.002 | Exfiltration to Cloud Storage | - |
Alias (315)
Malware Utilizzato (8)
Metadata
| ID: | 882 |
| Created: | 13/01/2026 17:48 |
| Updated: | 06/03/2026 16:00 |