EXOTIC LILY

Overview

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1203

TTPs — 15 techniques across 5 tactics

Tools & malware (2)

Bazar · Bumblebee

Reporting (1)

• Exposing initial access broker with ties to Conti — Stolyarov, V