MITRE ATT&CKgroup
G1011 EXOTIC LILY
- Domain
- enterprise
- Version
- 1.0
- Created
- 2022-08-18
Description
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.
Related
Uses · MITRE ATT&CK (17)
- S1039 Bumblebee software (malware)
- T1608.001 Upload Malware sub-technique
- S0534 Bazar software (malware)
- T1589.002 Email Addresses sub-technique
- T1593.001 Social Media sub-technique
- T1594 Search Victim-Owned Websites technique
- T1597 Search Closed Sources technique
- T1585.001 Social Media Accounts sub-technique
- T1585.002 Email Accounts sub-technique
- T1583.001 Domains sub-technique
- T1204.001 Malicious Link sub-technique
- T1204.002 Malicious File sub-technique
- T1566.001 Spearphishing Attachment sub-technique
- T1566.002 Spearphishing Link sub-technique
- T1566.003 Spearphishing via Service sub-technique
- T1203 Exploitation for Client Execution technique
- T1102 Web Service technique
References
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/ Google EXOTIC LILY March 2022