Home / Threat actors / EXOTIC LILY
EXOTIC LILY G1011
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
1
associated CVEs
15
Techniques
2
Malware and tools
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.”
Techniques by tactic
Reconnaissance
T1589.002 Email AddressesT1593.001 Social MediaT1594 Search Victim-Owned WebsitesT1597 Search Closed Sources Resource Development
T1583.001 DomainsT1585.001 Social Media AccountsT1585.002 Email AccountsT1608.001 Upload Malware Initial Access
T1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1566.003 Spearphishing via Service Execution
T1203 Exploitation for Client ExecutionT1204.001 Malicious LinkT1204.002 Malicious File Command and Control
T1102 Web Service © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.