Cinnamon Tempest

Cinnamon Tempest is a China-based threat group associated with the aliases DEV-0401, Emperor Dragonfly, and BRONZE STARLIGHT. Active since at least 2021, it has deployed multiple ransomware strains based on the leaked Babuk source code. Unlike typical ransomware operations, Cinnamon Tempest does not use an affiliate model or purchase access, instead acting independently throughout the attack lifecycle. The group's activities suggest a focus on intellectual property theft or cyberespionage rather than financial gain.