EXOTIC LILY is a financially motivated Initial Access Broker known for tailored spearphishing campaigns linked to Conti ransomware operations.
Analyst brief
EXOTIC LILY (also tracked as DEV-0413) is a financially motivated Initial Access Broker (IAB) closely linked to Conti and Diavol ransomware operations. They primarily target corporate entities, working with Russian cybercrime gangs like FIN12/WIZARD SPIDER to sell network access. Their main TTPs include reconnaissance via victim-owned websites, creation of fraudulent social media and email accounts, tailored spearphishing campaigns (delivering Bazar and Bumblebee loaders), and exploitation of zero-day vulnerabilities such as CVE-2021-40444. Defenders should focus on highly personalized phishing emails targeting employees, suspicious attachments, and ensuring patches for the Microsoft MSHTML vulnerability are applied to prevent deployment of Bazar/Bumblebee loaders.
EXOTIC LILY
DEV-0413
unknown
EXOTIC LILY is a resourceful, financially motivated group whose activities appear to be closely linked with data exfiltration and deployment of human-operated ransomware such as Conti and Diavol. In early September 2021, the group has been obeserved exploiting a 0day in Microsoft MSHTML (CVE-2021-40444). Investigation lead researchers to believe that they are an Initial Access Broker (IAB) who appear to be working with the Russian cyber crime gang known as FIN12 (Mandiant, FireEye) / WIZARD SPIDER (CrowdStrike). This threat actor deploys tactics, techniques and procedures (TTPs) that are traditionally associated with more targeted attacks, like spoofing companies and employees as a means of gaining trust of a targeted organization through email campaigns that are believed to be sent by real human operators using little-to-no automation. Additionally and rather uniquely, they leverage legitimate file-sharing services like WeTransfer, TransferNow and OneDrive to deliver the payload, namely BUMBLEEBEE and BAZARLOADER, further evading detection mechanisms. This level of human-interaction is rather unusual for cyber crime groups focused on mass scale operations.