- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(medium confidence)
- Seen
- to 2026
- Status
- Active
- ATT&CK
- G1011 · 15 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0297 · exotic-lily
RussiaWhat it is
EXOTIC LILY is a financially motivated group that has been closely linked with Wizard Spider and the deployment of ransomware including Conti and Diavol. EXOTIC LILY may be acting as an initial access broker for other malicious actors, and has targeted a wide range of industries including IT, cybersecurity, and healthcare since at least September 2021.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Lily Spider
- Microsoft
- Coldtrain, DEV-0413
- Proofpoint
- TA580
- Other names
- Projector Libra
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ThreatActor.info (Malpedia et al.)Russia · high
Tools
The tools and malware families the sources tie to it.
- Archelaus Beta
- Bazar
- Bumblebee
- Cyber Eye RAT
- CyberGate
- Xploit
Sources
- MITRE ATT&CK attack.mitre.org
- Malpedia malpedia.caad.fkie.fraunhofer.de