Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · EXOTIC LILY · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

EXOTIC LILY

  • DEV-0413

MITRE G1011 ↗

EXOTIC LILY — ATT&CK roseEL

attack rose · 15 techniques across 5 tactics

Analyst brief

misp-galaxy + mitre-attack

EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike).

This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation. Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, namely BUMBLEEBEE and BAZARLOADER, further evading detection mechanisms. This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

15 techniques · 5 of 15 tactics

  1. Reconnaissance

    4 techniques

  2. Resource development

    4 techniques

  3. Initial access

    3 techniques

  4. Execution

    3 techniques

  5. Command and control

    1 technique

select a technique

Arsenal

2 malware
Malware
Malware · 2ATT&CK
BazarS0534 ↗
BumblebeeS1039 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to EXOTIC LILY

none on KEV
  1. CVE-2021-404442026-10-17
    1. “The DEV-0413 campaign that used CVE-2021-40444 has been smaller and more targeted than other malware campaigns we have identified leveraging DEV-0365 infrastructure.”

      cited as used in a campaign · source: microsoft.com ↗ · 2026-10-17

    2. “In early September 2021, Threat Analysis Group (TAG) observed a financially motivated threat actor we refer to as EXOTIC LILY, exploiting a 0day in Microsoft MSHTML ( CVE-2021-40444 ).”

      cited as exploiting · source: blog.google ↗ · 2026-10-17

    3. “EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

4 sources
  1. 1.microsoft.com/security/blog/2021/09/15/analyzing-attacks-that-exploi…
  2. 2.blog.google/threat-analysis-group/exposing-initial-access-broker-t…
  3. 3.attack.mitre.org/groups/G1011
  4. 4.blog.google/threat-analysis-group/exposing-initial-access-broker-t…

Track EXOTIC LILY on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.