AdversaryGraph public intelligence page

This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.

Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.

Main AdversaryGraph project Documentation Malware Analysis GitHub

G1011 · 15 ATT&CK techniques · 0 correlated reports

EXOTIC LILY

Aliases: None listed

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

Open interactive actor investigation

ATT&CK techniques

T1566.003
Spearphishing via Service T1585.001
Social Media Accounts T1566.001
Spearphishing Attachment T1203
Exploitation for Client Execution T1566.002
Spearphishing Link T1204.002
Malicious File T1585.002
Email Accounts T1102
Web Service T1594
Search Victim-Owned Websites T1204.001
Malicious Link T1597
Search Closed Sources T1583.001
Domains T1593.001
Social Media T1589.002
Email Addresses T1608.001
Upload Malware

Correlated CTI and IR reports

Continue the investigation

Interactive AdversaryGraph AdversaryGraph documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas Insider Threat Detection Guide 1200km Medium research