Cinnamon Tempest
Cinnamon Tempest is a financially motivated threat actor tracked by Microsoft as DEV-0401 and also associated in the provided content with Emperor Dragonfly, BRONZE STARLIGHT, Highground, and SLIME34. Microsoft describes DEV-0401 as unique among human-operated ransomware actors because it is a confirmed China-based activity group. The content also states that third parties have linked its targeting, malware, and command-and-control infrastructure to the China-aligned BRONZE STARLIGHT group, and that BRONZE STARLIGHT’s main goal appears to be espionage rather than financial gain. Attribution beyond those stated links remains unclear in the source material. The actor is associated with initial access through exploitation of unpatched public-facing systems, including Exchange, ManageEngine AdSelfService Plus, Confluence, Log4j 2, and VMware Horizon. Microsoft observed DEV-0401 deploying Pandora ransomware in February 2022 and later shifting to LockBit 2.0 in April 2022. The content also notes a SentinelOne assessment that DLL side-loading functionality seen in a LockBit intrusion was likely implemented by an affiliate, probably DEV-0401. Observed tradecraft in the provided content includes PowerShell execution for command-and-control communications, file download, and reconnaissance; execution of ransomware via batch scripts deployed through Group Policy Objects; lateral movement via a customized Impacket wmiexec/WMI workflow; and use of weaponized DLLs to load and decrypt payloads, including DLL search-order hijacking. The actor is also described as using open-source or publicly available tools, including customized versions of the Iox proxy tool and NPS tunneling tool, Meterpreter, and a keylogger. Captured keystroke logs were uploaded to Alibaba Cloud Object Storage Service (Aliyun OSS). Microsoft also states that DEV-0401 frequently launched Cobalt Strike via DLL search-order hijacking and began replacing Cobalt Strike with Sliver around June 2022. The content further links related malware and infrastructure targeting Southeast Asia’s gambling sector to previous BRONZE STARLIGHT activity. In that reporting, HUI Loader variants, Alibaba OSS-hosted staging, sideloaded legitimate software components, and Cobalt Strike infrastructure were assessed as overlapping with China-aligned activity associated with BRONZE STARLIGHT/DEV-0401, though exact attribution was explicitly described as uncertain due to tooling and infrastructure sharing among Chinese clusters.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
47 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
15 malware families attributed to this actor across reporting.
10 additional families tracked in Mallory.
Associated vulnerabilities
10 CVEs this actor has used in observed campaigns. 10 of them exploited in the wild.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
In February of 2022, DEV-0401 was observed deploying the Pandora ransomware family, primarily via unpatched VMware Horizon systems vulnerable to the Log4j 2 CVE-2021-44228 vulnerability.
5 more CVEs tied to this actor tracked in Mallory.
Observables
49 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Listed as an associated threat actor for exploitation activity related to abuse of the Windows Cloud Files API / cldapi.dll detection.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with exploitation and privilege-escalation detection coverage for Windows admin password changes by non-admin users.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.