Skip to content

EXOTIC LILY

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

ATT&CK ID: G1011
Techniques: 11
Tools: 2

Vulnerabilities it has exploited

CVE-2021-40444 Microsoft MSHTMLUnscored · exploited in the wild

Techniques

Reconnaissance

Gather Victim Identity Information Search Open Websites/Domains Search Victim-Owned Websites Search Closed Sources

Resource Development

Acquire Infrastructure Establish Accounts Stage Capabilities

Initial Access

Execution

Exploitation for Client Execution User Execution

Command and Control

Software

Bazar · Bumblebee

MITRE ATT&CK All threat actors