EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.2
group
EXOTIC LILY G1011
- Created
- 18 August 2022
- Last modified
- 31 July 2026
- Alias
- EXOTIC LILY
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.[1]
15
Techniques44th pct
5
Tactics26th pct
2
Tools & malware39th pct
0
CampaignsNone recorded
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
MITRE reference G1011
EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.3
EXOTIC LILY has used malicious links to lure users into executing malicious payloads.4
EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.56
EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.78
EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.9
Standing G1011
Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
Reach
Techniques1544th pct
44th percentile · 56% of 176 ATT&CK groups have more Enterprise techniques.
Tactics526th pct
26th percentile · 74% of 176 ATT&CK groups have more tactics spanned.
Tools & malware239th pct
39th percentile · 61% of 176 ATT&CK groups have more tools and malware.
Campaigns089% tie · 4 values
89% of the population shares a single value across only 4 distinct values, so a percentile here would rank the tie, not the entity.
Coverage
Rules / technique1medBottom 6%
6th percentile · 94% of 176 ATT&CK groups have more detection rules per technique.
Tests / technique0med
Detection coverage G1011
188 distinct rules cover the 15 techniques recorded for this group. The 209 technique-to-rule mappings resolve to 188 distinct rules, because one rule can cover several techniques. 110 Sigma · 78 Splunk.
8 covered by at least one rule7 with no coverage188 distinct rules in total
tf
Loading...Drag headers to reorder | Drag edges to resize
tf
Loading detections...
| Select | Title | Description | Category | Status | Event | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
© 2026 The MITRE Corporation. ATT&CK® and D3FEND™ data reproduced with permission. SigmaHQ detection rules licensed under DRL 1.1. attack.mitre.org · d3fend.mitre.org · CAR analytics licensed under Apache 2.0 · car.mitre.org