[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fgLOi6ZI1PNxLd_zjj3ib3wKSi90KEoGkmD605or8RNU":3},{"success":4,"data":5},true,{"name":6,"slug":7,"aliases":8,"description":10,"country":11,"suspected_sponsor":11,"target_industries":12,"target_countries":13,"incident_types":14,"references":15,"techniques":18,"technique_count":41,"created_at":42,"seoMetadata":43,"schemaOrg":47},"EXOTIC LILY","exotic-lily",[9],"DEV-0413","EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) \u002F WIZARD SPIDER (CrowdStrike). This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation. Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, namely BUMBLEEBEE and BAZARLOADER, further evading detection mechanisms. This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.",null,[],[],[],[16,17],"https:\u002F\u002Fwww.microsoft.com\u002Fsecurity\u002Fblog\u002F2021\u002F09\u002F15\u002Fanalyzing-attacks-that-exploit-the-mshtml-cve-2021-40444-vulnerability","https:\u002F\u002Fblog.google\u002Fthreat-analysis-group\u002Fexposing-initial-access-broker-ties-conti",[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40],"T1583","T1583.001","T1585","T1585.001","T1585.002","T1203","T1589","T1589.002","T1566","T1566.001","T1566.002","T1566.003","T1597","T1593","T1593.001","T1594","T1608","T1608.001","T1204","T1204.001","T1204.002","T1102",22,"2023-08-09T17:25:09.409843+00:00",{"title":44,"metaDescription":45,"keywords":46},"EXOTIC LILY Threat Actor Profile | EdgeProtect","EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-...","EXOTIC LILY, DEV-0413, threat actor, APT, cyber threat, threat intelligence",{"@context":48,"@type":49,"name":6,"alternateName":50,"description":10,"url":51,"mainEntityOfPage":52},"https:\u002F\u002Fschema.org","Organization",[9],"https:\u002F\u002Fdev.precursorintelligence.com\u002Fthreat-actors\u002Fexotic-lily",{"@type":53,"@id":51},"WebPage"]