EXOTIC LILY

· ATT&CK GroupG1011

Techniques

Software

Tactics

Aliases

Description

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)

Tactic Coverage

resource development (4)reconnaissance (4)execution (3)initial access (3)command and control (1)

Techniques Used (15)

T1102Web Service

command and control

T1203Exploitation for Client Execution

execution

T1204.001Malicious Link

execution

T1204.002Malicious File

execution

T1566.001Spearphishing Attachment

initial access

Registration Required

Create a free account to access full Threat Actor Techniques

Showing 5 of 15 results

✓ Personal dashboard✓ Track 1 vendor/product✓ 1 keyword alert✓ Weekly digest✓ 1 CSV export/month

Already have an account? Sign in →

Software Used (2)

S0534Bazarmalware S1039Bumblebeemalware

References (2)

https://attack.mitre.org/groups/G1011 https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/