threat actor

EXOTIC LILY

unknownentity:threat_actor

EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPID

Curated · btcintel

claims we make, each with its source and citation · sources may contradict; we show the set, never a score

Facts

id: exotic-lily
kind: threat actor
status: unknown
aliases: DEV-0413
jurisdictions: —
claims naming it: 0 · 0 attributions · 2 relations · 0 events

Identifiers

attack G1011via mitre-attack
misp-galaxy 3ce2a9e0-c435-402a-a7f3-d48b64d1ab9dvia misp-galaxy-threat-actor

Relations

MITRE ATT&CK Enterpriserecords thatEXOTIC LILYusesBazar
fetch —sha256 dc1639caa5501d72
rel_50btcintel:relations:50@v1 sha256:f69453e7aa13f0bd
confidenceauthority data · 60
MITRE ATT&CK Enterpriserecords thatEXOTIC LILYusesBumblebee
fetch —sha256 dc1639caa5501d72
rel_51btcintel:relations:51@v1 sha256:529b6f88d5991cf7
confidenceauthority data · 60

Events

computedno dated events recorded for this entity

Claims naming this entity

computedno current claim names this entity

Subjects0 subjects carry a claim naming this entity · a sample

computedno subject carries a claim naming this entity

Community

notes from Nostr labelers · never merged with the bands above · not endorsed

Community content is indexed from Nostr and not endorsed by btcintel.

not computed yetNot indexed yet: the community index has not looked at this subject.