Cinnamon Tempest
IntrusionSet · ATTACK:enterprise:G1021
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1021",
"title": "Cinnamon Tempest",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1021",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--8b1e16f6-e7c8-4b7a-a5df-f81232c13e2f",
"external_id": "G1021",
"domain": "enterprise",
"created": "2023-12-06T19:53:04.988Z",
"modified": "2026-07-31T18:48:07.234Z",
"version": "1.0",
"aliases": [
"Cinnamon Tempest",
"DEV-0401",
"Emperor Dragonfly",
"BRONZE STARLIGHT"
],
"tactics": [
],
"source_references": [
{
"source_name": "BRONZE STARLIGHT"
},
{
"source_name": "DEV-0401"
},
{
"source_name": "Emperor Dragonfly"
},
{
"source_name": "Sygnia Emperor Dragonfly October 2022",
"url": "https://blog.sygnia.co/revealing-emperor-dragonfly-a-chinese-ransomware-group"
},
{
"source_name": "SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022",
"url": "https://www.secureworks.com/research/bronze-starlight-ransomware-operations-use-hui-loader"
},
{
"source_name": "Trend Micro Cheerscrypt May 2022",
"url": "https://www.trendmicro.com/en_se/research/22/e/new-linux-based-ransomware-cheerscrypt-targets-exsi-devices.html"
},
{
"source_name": "Microsoft Threat Actor Naming July 2023",
"url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
},
{
"source_name": "Microsoft Ransomware as a Service",
"url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
},
{
"source_name": "Dell SecureWorks BRONZE STARLIGHT Profile",
"url": "https://www.secureworks.com/research/threat-profiles/bronze-starlight"
}
]
}Explicit source assertions (27)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--01eddb48-5116-494c-9d1c-2ace79b28530
Sygnia Emperor Dragonfly October 2022 · Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0577a90e-88f7-4b33-8dd2-f5e123f63be2
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0beeaf4e-f9cf-46af-9e2f-116fff614d5f
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0633
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1a0bc35b-cc76-487b-a1a7-71cbfb110f24
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0664
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--24baf6e9-5d36-4503-a1c5-99b91220ed5b
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Ransomware as a Service · Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1484.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3143fbc9-22cf-4278-a9cd-17be6389e375
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1567.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--46bb2079-28aa-4f64-b2d8-fb111185e419
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d2c6d2c-f2ae-4447-8ba7-53250207ace2
Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--508c012e-c578-472d-8225-51bc8c0dff87
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--525624eb-cb0e-48b4-aa53-725a33696c8c
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1657
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ab5888b-f8c0-4230-af14-990356437dd5
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1090
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b68c97c-8eb7-45eb-b2d2-a91bf0fff2a0
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S1096
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6bbc5e8e-647a-41ba-bda2-e682d955d92c
Sygnia Emperor Dragonfly October 2022 · Trend Micro Cheerscrypt May 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e478b50-57b3-418b-b866-8441be0036b6
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1190
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7bf7f711-823d-41b8-8e88-801f7fa98591
Sygnia Emperor Dragonfly October 2022 · SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Microsoft Log4j Vulnerability Exploitation December 2021 · Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1059.006
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a0b1ab1f-9427-411a-9eba-649da629adaf
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad9f56c2-efb9-421e-99f5-d82396f89440
Sygnia Emperor Dragonfly October 2022 · Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--beee667c-c63d-48c9-86c1-54a50081199d
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6cf559e-1ead-4fba-9c61-72e33bae10e5
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1572
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8cae681-d480-4b85-ba37-d3d3265c98c2
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1080
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d0952afb-ce2a-43ee-bb6d-8daf90ebbd36
Microsoft Ransomware as a ServiceATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S0154
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--dc059a21-6a00-4b04-ac54-23f9a76f4f4b
Microsoft Ransomware as a Service · Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S1097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e2f8a71a-a4ea-4976-b282-f2df342134e4
SecureWorks BRONZE STARLIGHT Ransomware Operations June 2022 · Dell SecureWorks BRONZE STARLIGHT ProfileATTACK:enterprise:G1021 → uses → ATTACK:enterprise:S1040
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e5f53e43-5b6a-480c-b770-85ca47b17050
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e901a6ec-1cf6-4f13-aa2b-d2f997170a66
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ed25d74a-2536-4ffe-9dc4-b6ea8ae03b19
Sygnia Emperor Dragonfly October 2022ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f751a3d3-1fe5-4be9-8a01-511481458f7f
Microsoft Ransomware as a Service