EXOTIC LILY
- ID
- G1011
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]
Techniques used (15)
- T1102 Web Service
- T1203 Exploitation for Client Execution
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1566.003 Spearphishing via Service
- T1583.001 Domains
- T1585.001 Social Media Accounts
- T1585.002 Email Accounts
- T1589.002 Email Addresses
- T1593.001 Social Media
- T1594 Search Victim-Owned Websites
- T1597 Search Closed Sources
- T1608.001 Upload Malware