EXOTIC LILY

Exotic Lily, an initial access broker (IAB), has been active since at least September 2021. The entity conducts highly sophisticated phishing campaigns to gain initial access to organizations and then sells this access to other threat actors, including ransomware groups. A notable example of their modus operandi is an email impersonating an employee of a legitimate company. At one point, Exotic Lily was sending upwards of 5,000 emails a day to some 650 targeted global organizations. Furthermore, the IAB has been linked to Russia-based Evil Corp and SocGholish, a loader activated in 2018. In early September 2021, Google's Threat Analysis Group (TAG) observed Exotic Lily exploiting a zero-day vulnerability in Microsoft MSHTML (CVE-2021-40444). This financially motivated threat actor has shown previous connections to a Russian financially-motivated cybercrime group known as FIN12, and the Conti ransomware group. These connections were further emphasized in a March 2022 report by Google’s TAG, which showed ties between Exotic Lily and a ransomware operator dubbed "Space Kook" by Halcyon. SocGholish, linked to Exotic Lily, has been used by both Evil Corp and the IAB since its activation in 2018. It has also been associated with the Dridex gang malware operation. Exotic Lily, which breaks into corporate networks and then sells that access to other criminals, has proven to be a significant cybersecurity threat. Its activities underline the importance of robust security measures and constant vigilance against phishing attempts.