# EXOTIC LILY: threat group profile

> EXOTIC LILY is a threat group. Public reporting links it to 11 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/exotic-lily
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > EXOTIC LILY

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 11 (plus 11 sub-techniques) |
| Thought to operate from | Not known |
| Other names | 1 |
| Public reports | 2 |

## Who is EXOTIC LILY?

EXOTIC LILY is a threat group. Public reporting links it to 11 attack techniques.

### Also known as

DEV-0413

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike). This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation. Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, namely BUMBLEEBEE and BAZARLOADER, further evading detection mechanisms. This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.

## How does EXOTIC LILY attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 11 linked to EXOTIC LILY. Some techniques belong to more than one stage. Public reporting also lists 11 more specific variations of them, called sub-techniques.

### 1. Research (4)

- T1589: Gather Victim Identity Information
- T1593: Search Open Websites/Domains
- T1594: Search Victim-Owned Websites
- T1597: Search Closed Sources

### 2. Preparation (3)

- T1583: Acquire Infrastructure
- T1585: Establish Accounts
- T1608: Stage Capabilities

### 3. Getting in (1)

- T1566: Phishing

### 4. Running code (2)

- T1203: Exploitation for Client Execution
- T1204: User Execution

### 5. Staying in (0)

- None linked in public reporting.

### 6. Taking control (0)

- None linked in public reporting.

### 7. Hiding (0)

- None linked in public reporting.

### 8. Disabling defences (0)

- None linked in public reporting.

### 9. Stealing passwords (0)

- None linked in public reporting.

### 10. Looking around (0)

- None linked in public reporting.

### 11. Spreading (0)

- None linked in public reporting.

### 12. Gathering data (0)

- None linked in public reporting.

### 13. Keeping contact (1)

- T1102: Web Service

### 14. Taking data out (0)

- None linked in public reporting.

### 15. Causing damage (0)

- None linked in public reporting.

## Public reports about EXOTIC LILY

- https://www.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability
- https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti

## Frequently asked questions

### Who is EXOTIC LILY?

EXOTIC LILY is a threat group. Public reporting links it to 11 attack techniques.

### How does EXOTIC LILY attack?

Public reporting links EXOTIC LILY to 11 attack techniques. Most of them are about research, preparation and running code.

### How do I know if EXOTIC LILY is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact