EXOTIC LILY
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]
Techniques Used
| Domain | ID | Name | Use | |
|---|---|---|---|---|
| Enterprise | T1203 | 客户端执行漏洞利用 |
EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.[1] |
|
| Enterprise | T1585 | .001 | 建立账户: Social Media Accounts |
EXOTIC LILY has established social media profiles to mimic employees of targeted companies.[1] |
| .002 | 建立账户: Email Accounts |
EXOTIC LILY has created e-mail accounts to spoof targeted organizations.[1] |
||
| Enterprise | T1594 | 搜索受害者拥有的网站 |
EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.[1] |
|
| Enterprise | T1593 | .001 | 搜索开放网站/域: Social Media |
EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.[1] |
| Enterprise | T1597 | 搜索闭源 |
EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.[1] |
|
| Enterprise | T1589 | .002 | 收集受害者身份信息: Email Addresses |
EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.[1] |
| Enterprise | T1608 | .001 | 暂存能力: Upload Malware |
EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.[1] |
| Enterprise | T1204 | .001 | 用户执行: Malicious Link |
EXOTIC LILY has used malicious links to lure users into executing malicious payloads.[1] |
| .002 | 用户执行: Malicious File |
EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.[1][2] |
||
| Enterprise | T1102 | 网络服务 |
EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.[1] |
|
| Enterprise | T1583 | .001 | 获取基础设施: Domains |
EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to ".us", ".co" or ".biz".[1] |
| Enterprise | T1566 | .001 | 钓鱼: Spearphishing Attachment |
EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.[1][2] |
| .002 | 钓鱼: Spearphishing Link |
EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.[1] |
||
| .003 | 钓鱼: Spearphishing via Service |
EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.[1] |
||