EXOTIC LILY

Overview

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.

Naming & attribution

It uses 15 documented ATT&CK techniques — more than 43% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1597 Search Closed Sources — used by 1 of 174 groups
T1593.001 Social Media — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Transparent Tribe Pakistan — 6 shared techniques (26% overlap)
Elderwood China — 5 shared techniques (26% overlap)
LazyScripter — 7 shared techniques (25% overlap)
Mofang China — 4 shared techniques (24% overlap)
Moonstone Sleet North Korea — 8 shared techniques (22% overlap)
Saint Bear Russia — 6 shared techniques (22% overlap)

Malware families with tracked indicators

One family attributed to EXOTIC LILY, with 6 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.