EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.1
- Google EXOTIC LILY March 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1566.003 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1203 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1594 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1597 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1593.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589.002 | 2022 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2022 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1102 | Web Service | — |
| T1203 | Exploitation for Client Execution | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1566.003 | Spearphishing via Service | — |
| T1583.001 | Domains | — |
| T1585.001 | Social Media Accounts | — |
| T1585.002 | Email Accounts | — |
| T1589.002 | Email Addresses | — |
| T1593.001 | Social Media | — |
| T1594 | Search Victim-Owned Websites | — |
| T1597 | Search Closed Sources | — |
| T1608.001 | Upload Malware | — |
Aliases
EXOTIC LILY
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.