ChinaAssessedChina-basedMixedActive 2021 – 2022BRONZE STARLIGHT
Also known asCinnamon Tempest · DEV-0401 · Emperor Dragonfly
Summary
China-based group, active since mid-2021, that loads Cobalt Strike and PlugX with its HUI Loader and deploys short-lived ransomware families — LockFile, AtomSilo, Rook, NightSky and Pandora — with name-and-shame leak sites (T1486). Sophos CTU, which named it, finds it plausible that the ransomware is a smokescreen for intellectual-property theft or espionage; Microsoft, which tracks it as DEV-0401 / Cinnamon Tempest, classes it as financially motivated. Motivation is therefore recorded as mixed. It gains access by exploiting internet-facing servers (T1190): Confluence (CVE-2021-26084) and on-premises Exchange (CVE-2021-34473) in 2021, and Log4Shell in VMware Horizon from 4 January 2022, which led to NightSky. HUI Loader runs through DLL search-order hijacking of legitimate executables (T1574.001). In 2023 SentinelLABS linked HUI Loader and Cobalt Strike activity against the Southeast Asian gambling sector to it, cautioning that the exact grouping is unclear. Symantec's 2025 report of RA World ransomware deployed with espionage tooling cites Palo Alto's links to Bronze Starlight but ties the PlugX variant to Mustang Panda, so it is not recorded here. Cobalt Strike and Impacket are public tools and not listed. last_seen is the last campaign a source attributes without hedging (2022).
Attribution
Microsoft: China-based operator; Sophos CTU: located in China (moderate confidence)
Assessed by security researchers or MITRE ATT&CK; no government attribution on record.
- Microsoft Threat Intelligence (Research, 2022-01-10)
A China-based ransomware operator (as DEV-0401) - Sophos CTU (Research, 2026-10)
Located in China (moderate confidence)
Campaigns 3
| Campaign | Period | Targets | Sectors | Source |
|---|---|---|---|---|
| HUI Loader and Cobalt Strike against the Southeast Asian gambling sectorASSESSED | 2023 – 2023-08 | Southeast Asia | Gambling | SentinelLABS (2023-08) — "indicators point to" BRONZE STARLIGHT, "the exact grouping remains unclear"; end is the publication month |
| Log4Shell exploitation of VMware Horizon leading to NightSky ransomware | 2022-01 | Undisclosed | Undisclosed | Microsoft (2022-01-10 update) — "as early as January 4" |
| Confluence and Exchange exploitation deploying LockFile, AtomSilo and Rook ransomware | 2021 | Undisclosed | Undisclosed | Microsoft (Log4j guidance, January 2022 update) — "previously deployed"; Sophos CTU dates the group to mid-2021 |
Newest first. ASSESSED: tied to the actor with hedging or through an alias. CLAIMED: an allegation no independent source confirms.
MITRE ATT&CK techniques 3
| Initial Access1 | T1190Exploit Public-Facing Application |
|---|---|
| Stealth1 | T1574.001DLL |
| Impact1 | T1486Data Encrypted for Impact |
Malware and tools 7
| Name | Description | Platform |
|---|---|---|
| HUI Loader | Loader | Windows |
| PlugX | RAT | Windows |
| LockFile | Ransomware | Windows |
| AtomSilo | Ransomware | Windows |
| Rook | Ransomware | Windows |
| NightSky | Ransomware | Windows |
| Pandora | Ransomware | Windows |
Exploited vulnerabilities 3
| CVE | CVSS | Detail |
|---|---|---|
| CVE-2021-44228 | 10 | Apache Log4Shell (KEV 2021-12-10) |
| CVE-2021-26084 | 9.8 | Atlassian Confluence — OGNL injection (KEV 2021-11-03) |
| CVE-2021-34473 | 9.1 | Microsoft Exchange — ProxyShell RCE (KEV 2021-11-03) |
Highest CVSS first.
Infrastructure patterns
- Name-and-shame leak sites listing ransomware victims (Sophos CTU, 2026)
Reporting and advisories 4
- Microsoft
Guidance for preventing, detecting and hunting for Log4j 2 exploitation — DEV-0401 NightSky (Jan 2022) - SentinelLABS
Chinese entanglement — DLL hijacking in the Asian gambling sector (Aug 2023) - Sophos CTU
BRONZE STARLIGHT threat profile - Secureworks CTU (Sophos)
BRONZE STARLIGHT ransomware operations use HUI Loader (2022)