EXOTIC LILY

Overview

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

Naming & attribution

EXOTIC LILY is tracked under 1 names across the industry. It uses 15 documented ATT&CK techniques — more than 43% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1597 Search Closed Sources — used by 1 of 174 groups
• T1593.001 Social Media — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Transparent Tribe Pakistan — 6 shared techniques (26% overlap)
• Elderwood China — 5 shared techniques (26% overlap)
• LazyScripter — 7 shared techniques (25% overlap)
• Mofang China — 4 shared techniques (24% overlap)
• Moonstone Sleet North Korea — 8 shared techniques (22% overlap)
• Saint Bear Russia — 6 shared techniques (22% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 15 techniques across 5 tactics

Tools & malware (2)

Bazar · Bumblebee

Reporting (1)

• Exposing initial access broker with ties to Conti — Stolyarov, V