Cinnamon Tempest deploys ransomware, but several research teams assess that the encryption may be a smokescreen for intellectual property theft or espionage. This profile covers the China-based group that MITRE ATT&CK tracks as G1021, Microsoft as Cinnamon Tempest (formerly DEV-0401) and Secureworks as BRONZE STARLIGHT. It draws on MITRE ATT&CK v20, Microsoft Threat Intelligence, Secureworks Counter Threat Unit, SentinelLabs and Trend Micro, and keeps each source's own attribution wording. It is written for incident responders, SOC analysts and infrastructure owners who run internet-facing Exchange, Confluence, ManageEngine or VMware estates. It stays at behaviour level: what to detect and harden, not how the tools work.
Key takeaways
- Treat the ransom as a possible decoy. ATT&CK and Secureworks both note that the short life of each ransomware brand and the use of state-associated malware suggest theft or espionage may be the real aim, so scope for data loss, not only encryption.
- Unpatched public-facing servers are the entry point. Microsoft lists Exchange, ManageEngine ADSelfService Plus, Confluence and Log4j flaws, including VMware Horizon, as initial access routes.
- Domain admin is the goal before impact. Microsoft describes ransomware pushed through Group Policy from the NETLOGON share, which needs domain administrator rights.
- The tooling is shared with espionage groups. HUI Loader, PlugX and Cobalt Strike loaded by DLL search order hijacking are the recurring signals, with Sliver replacing Cobalt Strike from June 2022 in Microsoft's reporting.
- Brands change, behaviour does not. Pandora, Rook, LockBit 2.0 and Cheerscrypt payloads have all been linked to the group; detect the pre-ransomware chain rather than a ransomware name.
Who they are (names and aliases)
MITRE ATT&CK describes Cinnamon Tempest as a China-based group active since at least 2021, deploying several ransomware strains built from the leaked Babuk source code. It states that the group does not operate an affiliate model or buy access, and appears to act independently across the whole attack lifecycle. Sources differ on motive. Microsoft's naming table lists the group under China with the category "Financially motivated". Secureworks assesses with moderate confidence that the group is located in China, based on its use of HUI Loader and PlugX, and suggests ransomware may be a smokescreen for intellectual property theft or espionage. SentinelLabs describes BRONZE STARLIGHT as a suspected Chinese ransomware operator whose main aim appears to be espionage, using ransomware for distraction or misattribution.
| Name | Source | Notes |
|---|---|---|
| Cinnamon Tempest (G1021) | MITRE ATT&CK; Microsoft | Microsoft's "Tempest" family denotes financially motivated actors |
| DEV-0401 | Microsoft (former name) | Name used in Microsoft's May 2022 ransomware as a service report |
| HighGround | Microsoft naming table | Listed by Microsoft as another name |
| BRONZE STARLIGHT | Secureworks | Secureworks threat profile; also used by SentinelLabs |
| Emperor Dragonfly | Sygnia (listed in ATT&CK) | Sygnia's 2022 research is cited by ATT&CK for the group's tunnelling and keylogger tooling |
No source used for this page names individuals, and this page names none. For the wider context, see the China State Cyber Operations Guide.
Software associated in ATT&CK
| Software | Type | What sources say |
|---|---|---|
| HUI Loader (S1097) | Loader | Custom DLL loader that Secureworks and SentinelLabs describe as shared among several China-nexus groups |
| PlugX (S0013) | Remote access trojan | One of the reasons Secureworks links the group to China; see the PlugX and ShadowPad Malware Guide |
| Cobalt Strike (S0154); Sliver (S0633) | C2 frameworks | Beacons launched by DLL search order hijacking; Microsoft saw Sliver replace Cobalt Strike from about 6 June 2022 |
| Impacket (S0357) | Tool | Customised wmiexec.py that writes renamed output files, likely to dodge static detections (Microsoft) |
| Pandora (S0664) | Ransomware | Microsoft observed it from February 2022, mostly after Log4j exploitation of VMware Horizon |
| Cheerscrypt (S1096) | Ransomware (Linux, ESXi) | Trend Micro (May 2022): derived from leaked Babuk ESXi code, stops running VMs then encrypts .vmdk, .vmem, .vswp and .vmsn files |
| Rclone (S1040) | Tool | Cloud sync utility cited by ATT&CK for the group's data handling |
Microsoft also links the group to payloads rebuilt from Rook, which shares code with Babuk, and to LockBit 2.0 from April 2022. For the code lineage, see the Babuk and Leaked Builder Variants Guide.
Targeting and motivation
- Breadth: Secureworks describes victims across a range of industry verticals worldwide, posted to leak sites in name-and-shame schemes.
- Southeast Asian gambling (2023): SentinelLabs linked activity against Southeast Asian gambling companies, including ESET's Operation ChattyGoblin attack on support agents at a Philippine gambling company, to BRONZE STARLIGHT. SentinelLabs says this link should be treated with caution because Chinese groups share malware and infrastructure.
- Motive: Microsoft classes the group as financially motivated; ATT&CK, Secureworks and SentinelLabs point to espionage or IP theft, citing the short lifespan of each ransomware brand and the state-associated tooling. Plan for both: a ransom demand and a quiet data loss.
- Who should care: any organisation with internet-facing Exchange, Confluence, ManageEngine ADSelfService Plus or VMware Horizon, and anyone running ESXi hosts reachable from the corporate network.
Tactics and techniques (MITRE ATT&CK)
All IDs are ATT&CK v20 techniques recorded against G1021, except the row marked as an NHI Mgmt Group mapping of vendor reporting.
| Tactic | Technique | What sources describe | Primary defence |
|---|---|---|---|
| Initial access | T1190 Exploit Public-Facing Application | Exchange, ManageEngine ADSelfService Plus, Confluence and Log4j (VMware Horizon) | Patch internet-facing apps first; remove what is not needed |
| Initial access, persistence | T1078 Valid Accounts; T1078.002 Domain Accounts | Compromised user accounts used to deploy payloads; domain admin obtained before deployment | Tiered admin model; PAM for domain admins |
| Resource development | T1588.002 Tool | Customised Iox proxy, NPS tunnelling tool, Meterpreter and a keylogger | Application control on servers |
| Execution | T1059.001 PowerShell; T1059.003 Windows Command Shell; T1059.006 Python | PowerShell for C2 and reconnaissance; batch scripts for ransomware; customised wmiexec.py | PowerShell script block logging; Constrained Language Mode |
| Execution, stealth | T1574.001 DLL; T1140 Deobfuscate/Decode Files or Information | Search order hijacking to launch Cobalt Strike; DLLs that decrypt payloads | Alert on signed binaries loading DLLs from user-writable paths |
| Persistence | T1543.003 Windows Service | Services created for deployed tooling | Alert on Event ID 7045 on servers |
| Lateral movement | T1047 Windows Management Instrumentation; T1021.002 SMB/Windows Admin Shares | Impacket over WMI and SMBexec | Restrict admin shares and remote WMI to admin hosts |
| Defence impairment, privilege escalation | T1484.001 Group Policy Modification | GPO used to run ransomware batch scripts | Alert on GPO changes (Event ID 5136); delegate GPO edit rights tightly |
| Lateral movement | T1080 Taint Shared Content | Ransomware run from a batch file on a network share, usually NETLOGON | File integrity monitoring on SYSVOL and NETLOGON |
| Command and control | T1090 Proxy; T1572 Protocol Tunneling; T1105 Ingress Tool Transfer | Iox and NPS combined to carry multiple connections through one tunnel | Egress allow-lists for servers |
| Exfiltration | T1567.002 Exfiltration to Cloud Storage | Keystroke logs uploaded to Alibaba Cloud Object Storage Service | Block unsanctioned cloud storage from servers |
| Impact | T1657 Financial Theft | Leak sites used to pressure victims to pay | Data loss scoping; legal and regulator plan |
| Impact (NHIMG mapping) | T1486 Data Encrypted for Impact | Pandora, Rook-based, LockBit 2.0 and Cheerscrypt encryption | Immutable backups with separate credentials |
Technique deep dives: T1190 Exploit Public-Facing Application, T1574 Hijack Execution Flow and MITRE ATT&CK T1484 Domain or Tenant Policy Modification.
How they abuse identities and credentials
- Privileged credentials from the first exploit: Microsoft notes that the vulnerabilities the group favours give elevated credentials at initial access. ManageEngine ADSelfService Plus and Exchange servers often hold or reach high-privilege service accounts, so patch them as identity infrastructure, not just web servers.
- Domain admin for deployment: GPO-based deployment from NETLOGON requires domain administrator level rights. Keep domain admins few, use them only from privileged access workstations, and alert on any domain admin logon to a member server. See the Group Policy Security Guide.
- Valid user accounts for services: ATT&CK records compromised user accounts used to create services. Service creation by an interactive user account on a server is rare and worth an alert.
- Cloud storage credentials in tooling: the keylogger uploaded to an Alibaba Cloud bucket, which means the tool carried credentials for an attacker-owned storage account. Outbound access to object storage from servers should be allow-listed by destination, not left open. See T1567 Exfiltration Over Web Service.
- Recovery of identity systems: once domain admin and GPO have been used, assume krbtgt and all privileged credentials are exposed. See Recovering IAM and PAM After Ransomware or Domain Compromise.
Notable activity
| Date | Event | Source |
|---|---|---|
| 2021 | Group active, deploying ransomware built from leaked Babuk code | MITRE ATT&CK |
| February 2022 | Pandora ransomware deployed, mostly after Log4j exploitation of VMware Horizon | Microsoft |
| April 2022 | LockBit 2.0 payloads deployed | Microsoft |
| May 2022 | Cheerscrypt ESXi ransomware analysed | Trend Micro |
| June 2022 | Sliver begins replacing Cobalt Strike; Secureworks publishes on HUI Loader use | Microsoft; Secureworks |
| 2023 | HUI Loader and Cobalt Strike activity against Southeast Asian gambling companies, tentatively linked to BRONZE STARLIGHT | SentinelLabs |
In the 2023 activity SentinelLabs reported a likely stolen code signing certificate issued to the vendor of Ivacy VPN, later revoked by DigiCert, and DLL hijacking of legitimate Adobe Creative Cloud, Microsoft Edge and McAfee executables. Signed binaries are not proof of safety.
Detection and defence
What to monitor
| Signal | Data source | Why it matters |
|---|---|---|
| Web server, Tomcat or Horizon processes spawning PowerShell, cmd.exe or curl | EDR; Sysmon Event ID 1 | Post-exploitation of public-facing apps |
| Signed executables loading unsigned DLLs from ProgramData, Temp or user folders | EDR image load events; Sysmon Event ID 7 | HUI Loader and Cobalt Strike sideloading |
| WMI or SMB remote execution writing output files to ADMIN$ or C$ | EDR; Security Event IDs 4624 type 3 and 5145 | Impacket wmiexec and smbexec lateral movement |
| New services on servers | System Event ID 7045; Security Event ID 4697 | Tooling persistence |
| GPO changes and new scripts in SYSVOL or NETLOGON | Directory Service Changes Event ID 5136; file integrity monitoring | Ransomware staging through Group Policy |
| Servers connecting to object storage or unusual tunnelling endpoints | Proxy, firewall and DNS logs | Iox and NPS tunnels; exfiltration to cloud storage |
| ESXCLI commands stopping many VMs | ESXi shell and hostd logs forwarded to SIEM | Cheerscrypt behaviour before encryption |
For C2 tuning see the Cobalt Strike Abuse Detection Guide.
Phased response plan
- Close the known doors: inventory internet-facing Exchange, Confluence, ManageEngine ADSelfService Plus and VMware Horizon, patch CISA KEV-listed flaws first and remove anything unused. See the Microsoft Exchange Server Security Guide and the Confluence Data Center Hardening Guide.
- Contain the server tier: egress allow-lists for servers, no direct internet from domain controllers, and admin shares and remote WMI reachable only from admin hosts. Pilot on one server group and keep the previous firewall policy for rollback.
- Lock down Group Policy: limit who can edit GPOs and link them, alert on Event ID 5136, and monitor SYSVOL and NETLOGON for new scripts.
- Protect credentials: Windows LAPS on every server, Credential Guard, and the attack surface reduction rules Microsoft names for this group (block credential stealing from LSASS; block process creation from PsExec and WMI commands), first in audit mode.
- Harden the defenders: EDR tamper protection and EDR in block mode, as Microsoft recommends.
- Make encryption survivable: immutable or offline backups with credentials outside the domain, and ESXi management isolated from user networks. See the ESXi Ransomware Playbook.
Decision guidance
- Ransomware or espionage response: run both tracks. Restore from backup, and in parallel scope what was accessed before encryption, because the encryption may be the least important event.
- Small organisations: move Exchange and collaboration tools to managed SaaS where possible, use a managed EDR with tamper protection, and keep one offline backup.
- Large organisations: add hunting for DLL sideloading by signed binaries, GPO change alerting and egress controls for servers, and rehearse a forest recovery.
Metrics
- Internet-facing applications with an unpatched KEV-listed flaw (target zero).
- Number of accounts with rights to edit or link GPOs, reviewed quarterly.
- Percentage of servers with Windows LAPS and Credential Guard enabled.
- Percentage of servers with an egress allow-list in place.
- Time to restore a domain controller and an ESXi host from isolated backup in exercises.
Framework mapping
| Control area | NIST SP 800-53 Rev. 5 | NIST CSF 2.0 |
|---|---|---|
| Patch public-facing applications | SI-2, RA-5 | ID.RA-01, PR.PS-02 |
| Least privilege for domain and GPO administration | AC-6, AC-2 | PR.AA-05 |
| Server egress and segmentation | SC-7 | PR.IR-01 |
| Application control on servers | CM-7 | PR.PS-02 |
| Monitoring for sideloading, services and GPO change | SI-4, AU-6 | DE.CM-09 |
| Backups | CP-9 | PR.DS-11 |
Common failure patterns
- Closing the case at decryption: treating the event as pure ransomware leaves the data theft unscoped.
- Hunting for a ransomware brand: the group changes payload names often; detections tied to one family miss the next one.
- Trusting signed binaries: DLL sideloading through legitimate, signed executables passes allow-lists that only check the main executable.
- Broad GPO edit rights: anyone who can edit a linked GPO can run code on every machine in its scope.
- Self-service password tools left unpatched: ADSelfService Plus sits next to Active Directory with privileged access, so a flaw there is a domain risk.
Practitioner checklist
- Patch or retire internet-facing Exchange, Confluence, ManageEngine ADSelfService Plus and VMware Horizon.
- Hunt for signed executables loading DLLs from writable paths.
- Alert on GPO changes and new scripts in SYSVOL and NETLOGON.
- Restrict remote WMI and admin shares to admin hosts.
- Deploy Windows LAPS, Credential Guard and the LSASS and PsExec/WMI ASR rules.
- Apply egress allow-lists to servers, including cloud object storage.
- Enable EDR tamper protection and block mode.
- Keep immutable backups with non-domain credentials and test ESXi restores.
- Run data loss scoping alongside every ransomware recovery.
Standards and references
- MITRE ATT&CK: Cinnamon Tempest (G1021)
- Microsoft Threat Intelligence: Ransomware as a service, understanding the cybercrime gig economy
- Microsoft: How Microsoft names threat actors
- Secureworks: BRONZE STARLIGHT threat profile
- SentinelLabs: China's BRONZE STARLIGHT targets the Southeast Asian gambling sector
- Trend Micro: New Linux-based ransomware Cheerscrypt targets ESXi devices
- CISA: Known Exploited Vulnerabilities Catalog
- NIST: SP 800-53 Rev. 5
Related NHI Mgmt Group resources: China State Cyber Operations Guide · APT41 Threat Actor Profile · LockBit Threat Actor Profile · Babuk and Leaked Builder Variants Guide · PlugX and ShadowPad Malware Guide