Cinnamon Tempest

BRONZE STARLIGHT DEV-0401 Emperor Dragonfly G1021

▲ High Threat

RA World Extortion, SE Asia and Europe Espionage, AtomSilo Resurgence

Origin China

Sponsor Chinese Government

Motivation Cyberespionage and intellectual property theft; secondary financial gain

Target Sectors

Government ministries Telecommunications Software and Services Manufacturing Pharmaceuticals Legal Services Media Virtualization stacks (VMware ESXi)

DLL Side-loading (utilizing legitimate executables such as toshdpdb.exe)

HUI Loader

PlugX (Korplug) backdoor

Cobalt Strike

NPS Proxy for covert communication

Exploitation of public-facing applications (e.g., CVE-2024-0012 in PAN-OS)

Ransomware as a diversionary tactic

Exfiltration to cloud storage (Amazon S3)

PowerShell and Python scripting for reconnaissance and C2

CISA Advisories ↗

Hacking the mainframe…