Trusted Design

EXOTIC LILY

アクターID: G1011

· MITRE Pageへのリンク

脅威アクターの詳細

EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.(Citation: Google EXOTIC LILY March 2022)

脅威アクターの別名・別称

EXOTIC LILY

利用した攻撃手法

• T1114 - Email Collection
• T1087.002 - Domain Account
• T1543.003 - Windows Service
• T1598.003 - Spearphishing Link
• T1091 - Replication Through Removable Media
• T1098.007 - Additional Local or Domain Groups
• T1183 - Image File Execution Options Injection
• T1134.002 - Create Process with Token
• T1612 - Build Image on Host
• T1149 - LC_MAIN Hijacking
• T1565 - Data Manipulation
• T1690 - Prevent Command History Logging
• T1218.010 - Regsvr32
• T1027.018 - Invisible Unicode
• T1547.008 - LSASS Driver

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027.018)
• CVE-2015-1770 (T1027.018)
• CVE-2015-2545 (T1027.018)
• CVE-2017-0199 (T1027.018)
• CVE-2012-0158 (T1027.018)
• CVE-2013-3906 (T1218.010)
• CVE-2014-6352 (T1218.010)
• CVE-2015-0016 (T1027.018)
• CVE-2010-3333 (T1027.018)
• CVE-2010-0188 (T1027.018)
• CVE-2010-2884 (T1087.002)
• CVE-2013-0640 (T1087.002)
• CVE-2011-0611 (T1547.008)
• CVE-2015-0071 (T1027.018)
• CVE-2010-1553 (T1547.008)
• CVE-2014-1761 (T1218.010)
• CVE-2015-2853 (T1027.018)
• CVE-2017-16929 (T1027.018)
• CVE-2012-1876 (T1027.018)
• CVE-2012-2539 (T1027.018)
• CVE-2013-3660 (T1027.018)
• CVE-2013-7331 (T1134.002)
• CVE-2009-3129 (T1547.008)
• CVE-2013-5990 (T1547.008)
• CVE-2015-5119 (T1027.018)
• CVE-2015-5122 (T1027.018)
• CVE-2012-1856 (T1027.018)
• CVE-2015-2546 (T1547.008)
• CVE-2014-6332 (T1027.018)
• CVE-2015-3043 (T1027.018)
• CVE-2015-3090 (T1547.008)
• CVE-2015-2590 (T1027.018)
• CVE-2015-2424 (T1027.018)
• CVE-2015-0097 (T1027.018)
• CVE-2015-2502 (T1027.018)
• CVE-2014-6271 (T1547.008)
• CVE-2014-4113 (T1027.018)
• CVE-2012-1889 (T1091)
• CVE-2016-1010 (T1547.008)
• CVE-2016-0984 (T1027.018)
• CVE-2016-0998 (T1547.008)
• CVE-2015-1641 (T1027.018)
• CVE-2015-1701 (T1027.018)
• CVE-2015-0313 (T1027.018)
• CVE-2015-0359 (T1027.018)
• CVE-2014-0329 (T1027.018)
• CVE-2015-5130 (T1547.008)
• CVE-2015-5134 (T1547.008)
• CVE-2015-5539 (T1547.008)
• CVE-2015-5557 (T1547.008)
• CVE-2015-5563 (T1547.008)
• CVE-2015-5559 (T1547.008)
• CVE-2015-5540 (T1547.008)
• CVE-2015-5561 (T1547.008)
• CVE-2015-5551 (T1547.008)
• CVE-2015-5564 (T1547.008)
• CVE-2015-5565 (T1547.008)
• CVE-2015-5550 (T1547.008)
• CVE-2015-5566 (T1547.008)
• CVE-2015-5127 (T1547.008)
• CVE-2015-5556 (T1547.008)
• CVE-2015-3628 (T1218.010)
• CVE-2015-6034 (T1091)
• CVE-2015-2852 (T1027.018)
• CVE-2012-4969 (T1027.018)
• CVE-2015-6585 (T1183)
• CVE-2015-6022 (T1027.018)
• CVE-2015-8287 (T1218.010)
• CVE-2016-2343 (T1612)
• CVE-2017-0263 (T1547.008)
• CVE-2017-0261 (T1027.018)
• CVE-2017-0262 (T1027.018)
• CVE-2016-9494 (T1027.018)
• CVE-2016-9496 (T1027.018)
• CVE-2016-9495 (T1027.018)
• CVE-2025-55182 (T1027.018)
• CVE-2015-0311 (T1027.018)
• CVE-2010-3081 (T1134.002)
• CVE-2012-3213 (T1027.018)
• CVE-2012-4792 (T1027.018)
• CVE-2014-0322 (T1027.018)
• CVE-2015-0336 (T1547.008)
• CVE-2011-3544 (T1027.018)
• CVE-2014-7911 (T1091)
• CVE-2015-3636 (T1091)
• CVE-2013-6282 (T1091)
• CVE-2015-3105 (T1218.010)
• CVE-2017-17215 (T1027.018)
• CVE-2013-0074 (T1027.018)
• CVE-2012-0507 (T1547.008)
• CVE-2013-2465 (T1547.008)
• CVE-2013-2551 (T1027.018)
• CVE-2012-4681 (T1027.018)
• CVE-2014-1776 (T1027.018)
• CVE-2014-0556 (T1547.008)
• CVE-2015-0057 (T1027.018)
• CVE-2012-1723 (T1027.018)
• CVE-2015-1761 (T1027.018)
• CVE-2014-8440 (T1027.018)
• CVE-2010-0806 (T1027.018)
• CVE-2015-2360 (T1027.018)
• CVE-2014-4148 (T1027.018)
• CVE-2011-3402 (T1027.018)
• CVE-2014-6324 (T1027.018)
• CVE-2014-7247 (T1547.008)
• CVE-2013-2678 (T1027.018)
• CVE-2015-2426 (T1027.018)
• CVE-2008-1436 (T1091)
• CVE-2010-0232 (T1027.018)
• CVE-2010-4398 (T1027.018)
• CVE-2012-6422 (T1547.008)
• CVE-2013-2595 (T1091)
• CVE-2015-4902 (T1547.008)
• CVE-2014-3897 (T1027.018)
• CVE-2015-2387 (T1027.018)
• CVE-2010-2572 (T1027.018)
• CVE-2011-1255 (T1027.018)
• CVE-2017-8570 (T1547.008)
• CVE-2012-0611 (T1027.018)
• CVE-2015-2419 (T1027.018)
• CVE-2016-0189 (T1027.018)
• CVE-2016-4117 (T1218.010)
• CVE-2017-0001 (T1547.008)
• CVE-2017-0143 (T1547.008)
• CVE-2023-1389 (T1547.008)
• CVE-2025-24893 (T1547.008)
• CVE-2025-31125 (T1027.018)
• CVE-2025-34026 (T1027.018)
• CVE-2025-55183 (T1027.018)
• CVE-2025-55184 (T1027.018)
• CVE-2025-66478 (T1547.008)
• CVE-2025-68645 (T1027.018)
• CVE-2026-20127 (T1027.018)
• CVE-2026-0723 (T1098.007)
• CVE-2016-1898 (T1027.018)
• CVE-2016-1897 (T1027.018)
• CVE-2016-1562 (T1612)
• CVE-2016-6532 (T1612)
• CVE-2015-7645 (T1027.018)
• CVE-2015-3113 (T1218.010)
• CVE-2015-4495 (T1218.010)
• CVE-2015-7808 (T1218.010)
• CVE-2016-1001 (T1547.008)
• CVE-2015-2854 (T1027.018)
• CVE-2015-7755 (T1218.010)
• CVE-2014-3153 (T1218.010)
• CVE-2014-0497 (T1218.010)
• CVE-2014-8361 (T1218.010)
• CVE-2014-0515 (T1218.010)
• CVE-2015-0310 (T1218.010)
• CVE-2014-9163 (T1218.010)
• CVE-2017-12149 (T1027.018)
• CVE-2013-2094 (T1027.018)
• CVE-2015-8562 (T1027.018)
• CVE-2015-7261 (T1027.018)
• CVE-2015-6036 (T1027.018)
• CVE-2010-1297 (T1027.018)
• CVE-2015-1427 (T1547.008)
• CVE-2016-1019 (T1547.008)
• CVE-2016-1287 (T1547.008)
• CVE-2013-0634 (T1547.008)
• CVE-2010-0738 (T1547.008)
• CVE-2014-3393 (T1547.008)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る