EXOTIC LILY

Executive Summary

EXOTIC LILY, also known as DEV-0413, is a financially motivated threat actor closely linked with Wizard Spider, known for deploying ransomware such as Conti and Diavol. The group has been active since at least September 2021, targeting various industries including IT, cybersecurity, and healthcare. EXOTIC LILY's activities suggest they may be acting as an initial access broker for other malicious actors.

Goals & Targeting

EXOTIC LILY's strategic objectives are centered around gaining initial access to target networks and exploiting them for financial gain. The group targets a wide range of industries, including IT, cybersecurity, and healthcare, in pursuit of lucrative paydays. Their typical victims are organizations with valuable data or systems that can be compromised for ransom, highlighting the importance of robust cybersecurity measures to prevent such attacks.

The close links between EXOTIC LILY and Wizard Spider highlight the complex and interconnected nature of the cyber threat landscape. EXOTIC LILY's potential role as an initial access broker for other malicious actors adds another layer of complexity, as it suggests that they may be facilitating the activities of other threat groups. This underscores the need for organizations to remain vigilant and proactive in their cybersecurity posture, as the threat landscape continues to evolve and become more sophisticated.

Key Capabilities

• Initial access brokering
• Ransomware deployment
• Network exploitation
• Data exfiltration
• Lateral movement

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

EXOTIC LILY's campaign patterns are characterized by their opportunistic and adaptable nature, with the group pursuing a wide range of industries and organizations. Their operational tempo is likely to be high, with multiple concurrent campaigns and operations. Notable past operations include the deployment of Conti and Diavol ransomware, highlighting the group's focus on financial gain. The group's activities have been observed since at least September 2021, with a potential increase in activity in recent months.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 over DNS using fast-flux
• Staging infrastructure on bulletproof hosting

Recommended Actions

• Implement robust email security controls to prevent spear-phishing
• Conduct regular network vulnerability assessments
• Enforce strong password policies and multi-factor authentication
• Monitor for suspicious DNS activity
• Implement a robust incident response plan

Suggested Tags