Cinnamon Tempest
Threat actorAttributed to China by MITRE ATT&CK (source). An attribution, not a proven fact.
Names and who uses them
- Cinnamon TempestOur name
- DEV-0401Microsoft
- BRONZE STARLIGHTMITRE ATT&CK
- Emperor DragonflyMITRE ATT&CK
Known techniques
- T1021.002SMB/Windows Admin Shares
- T1047Windows Management Instrumentation
- T1059.001PowerShell
- T1059.003Windows Command Shell
- T1059.006Python
- T1078Valid Accounts
- T1078.002Domain Accounts
- T1080Taint Shared Content
- T1090Proxy
- T1105Ingress Tool Transfer
- T1140Deobfuscate/Decode Files or Information
- T1190Exploit Public-Facing Application
- T1484.001Group Policy Modification
- T1543.003Windows Service
- T1567.002Exfiltration to Cloud Storage
- T1572Protocol Tunneling
- T1574.001DLL
- T1588.002Tool
- T1657Financial Theft
Malware and tools used
Source: MITRE ATT&CKRecent news
No stories yet.