Description
[Cinnamon Tempest](https://attack.mitre.org/groups/G1021) is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked [Babuk](https://attack.mitre.org/software/S0638) source code. [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle. Based on victimology, the short lifespan of each ransomware variant, and use of malware attributed to government-sponsored threat groups, [Cinnamon Tempest](https://attack.mitre.org/groups/G1021) may be motivated by intellectual property theft or cyberespionage rather than financial gain.(Citation: Microsoft Ransomware as a Service)(Citation: Microsoft Threat Actor Naming July 2023)(Citation: Trend Micro Cheerscrypt May 2022)(Citation: SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022)
Techniques Used (TTPs)
- T1047 — Windows Management Instrumentation (execution)
- T1574.001 — DLL (persistence, privilege-escalation, defense-evasion)
- T1105 — Ingress Tool Transfer (command-and-control)
- T1484.001 — Group Policy Modification (defense-evasion, privilege-escalation)
- T1567.002 — Exfiltration to Cloud Storage (exfiltration)
- T1588.002 — Tool (resource-development)
- T1078 — Valid Accounts (defense-evasion, persistence, privilege-escalation, initial-access)
- T1657 — Financial Theft (impact)
- T1090 — Proxy (command-and-control)
- T1078.002 — Domain Accounts (defense-evasion, persistence, privilege-escalation, initial-access)
- T1190 — Exploit Public-Facing Application (initial-access)
- T1059.006 — Python (execution)
- T1140 — Deobfuscate/Decode Files or Information (defense-evasion)
- T1021.002 — SMB/Windows Admin Shares (lateral-movement)
- T1572 — Protocol Tunneling (command-and-control)
- T1080 — Taint Shared Content (lateral-movement)
- T1543.003 — Windows Service (persistence, privilege-escalation)
- T1059.001 — PowerShell (execution)
- T1059.003 — Windows Command Shell (execution)
Total TTPs: 19
Malware & Tools
Malware: Cheerscrypt, Cobalt Strike, HUI Loader, Pandora, PlugX