Forensia CTI Core

Profile

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

MITRE ATT&CK ↗

Techniques

15 ATT&CK techniques attributed to this actor.

T1102 Web Service T1203 Exploitation for Client Execution T1204.001 Malicious Link T1204.002 Malicious File T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link T1566.003 Spearphishing via Service T1583.001 Domains T1585.001 Social Media Accounts T1585.002 Email Accounts T1589.002 Email Addresses T1593.001 Social Media T1594 Search Victim-Owned Websites T1597 Search Closed Sources T1608.001 Upload Malware

Software

2 malware/tools attributed to this actor.

BazarBumblebee

Related corpus activity

8,744 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to EXOTIC LILY.

Indicator	Type	Family	Sev	Src
cve-2024-1781	cve	—	85	1
cve-2018-8007	cve	—	85	1
cve-2017-17215	cve	—	85	2
cve-2025-68670	cve	—	85	2
cve-2026-3102	cve	—	85	3
cve-2022-47945	cve	—	85	1
ad10ff9043d6f327045943635fcbd0c5918acb79dc998db92ee4c7dee5224710	sha256	—	80	1
7900c2772680523cadc9fe4e07300d45500191ba64ff5b91573531b133840b14	sha256	phishing	80	2
5864a697bd7b339f56b05405f29a097cd027cafdcc4e63c2aaeccccbf930605f	sha256	—	80	1
62a879b0d1c1649cc72b2b6f61a8f6bd888625ce6e8a7aefe0a0461e4f27c525	sha256	phishing	80	2
e5e43b0830369c39fab45363486da4d21a98c5097ea262c9816997f11c73c1c4	hash	phishing	80	2
e4ccb2328c06710a7f0254cb6315e1b106396b0ff525f9cf3eada6e85d285c1c	sha256	—	80	1
c099f965144bccd0b590f946659fc3c0747c54aef505b6caaca9078712f455fb	sha256	—	80	1
64c7dd0a3a3ae49977ac05913d3878000cce14e5d8c1ee05b782bdfd648bde91	sha256	—	80	1
5ab41cf20315d2ea1385967d588159873a65ef5581a0b78de06c0d8617894194	sha256	phishing	80	2
669002654c264191d4660fbf757860d930175649735f81370b9f1af3658a304c	sha256	phishing	80	2
6c6cbed6aad96564ed87094785be07a1	hash	phishing	80	2
248ded4723e9f5da793e5e42d1ba7c2293dd704718f149b84b3b9b818a1f51db	sha256	phishing	80	2
61e9d76f07334843df561fe4bac449fb6fdaed5e5eb91480bded225f3d265c5f	hash	phishing	80	2
43d597783af656a35184021f5e20686896463a1712f9216e0217a2ca740e3935	sha256	phishing	80	2
60972abf5425c191c81bae117f1dedaea13d39bc52f367d5dff9ad1aa4b9c5ca	sha256	phishing	80	2
9758e76b601798a30d903bf05052a53df80451e5c156548ce9da828f608b6470	sha256	—	80	1
a7bd8869293212e1671df90d2d41b96d4933eb9408b1111bd830e111a91bb202	hash	phishing	80	2
50ebf107d522326c9a9db8821fe3263aa5136964faaf5dd183657bbb52725f84	sha256	phishing	80	2
44a4ac119349f525d877728b53fe38453a516881d577679caf08ab69312a695f	sha256	phishing	80	2
107b5aa3c4ef30b9b832e0a10b1efb1dcf433158bc6af8d890d66c0c9ed50d21	sha256	—	80	1
22de84e8f29cba932cf65cf4dc1d333cb8b2e468204f97030712bee32691ac3b	sha256	phishing	80	2
5115277eabf2d22d49dcef1e155874387d8e783853bd86debf7ff58588aae35d	sha256	phishing	80	2
771a47120b935e218322046e838347d722d265b91f1afdef91194a5bec86a97a	sha256	phishing	80	2
55d6238b01a177e25eb7d53c943f3abea64ec073	hash	phishing	80	2

Showing the top 30 by severity of 8,744.