Threat actor · G1011

EXOTIC LILY

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

ATT&CK techniques

15 mapped

T1102 T1203 T1204.001 T1204.002 T1566.001 T1566.002 T1566.003 T1583.001 T1585.001 T1585.002 T1589.002 T1593.001 T1594 T1597 T1608.001