Cinnamon Tempest
Cinnamon Tempest is a China-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 13 sectors, including Government and Technology, in 9 countries, including the United States and India. It uses 19 MITRE ATT&CK techniques and exploits 8 known CVEs.
- DEV-0401
- Emperor Dragonfly
- BRONZE STARLIGHT
- Operation ChattyGoblin
- SLIME34
- HighGround
- Origin
- China
- Techniques
- 19
- Exploited CVEs
- 8
- First seen
- Jan 1, 2021
- Last seen
- Oct 3, 2022
- Record updated
Who They Target.
About Cinnamon Tempest.
Cinnamon Tempest is a China-based threat group that has been active since at least 2021 deploying multiple strains of ransomware based on the leaked Babuk source code. Cinnamon Tempest does not operate their ransomware on an affiliate model or purchase access but appears to act independently in all stages of the attack lifecycle.
Last updated Sep 11, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.