Cheerscrypt — Malware Profile

Cheerscrypt is a ransomware that was developed by Cinnamon Tempest and has been used in attacks against ESXi and Windows environments since at least 2022. Cheerscrypt was derived from the leaked Babuk source code and has infrastructure overlaps with deployments of Night Sky ransomware, which was also derived from Babuk.

MITRE ATT&CK techniques (5)

• T1059.012 Hypervisor CLI
• T1083 File and Directory Discovery
• T1486 Data Encrypted for Impact
• T1489 Service Stop
• T1673 Virtual Machine Discovery

Attributed threat actors

• Cinnamon Tempest

Read the full analysis on IntelFusions