https://www.hivepro.com/wp-content/uploads/2022/03/TA2022068.pdf

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

Exotic Lily was first discovered exploiting a zero-day vulnerability in Microsoft MSHTML (CVE-2021-40444), which piqued the curiosity of researchers as a potentially sophisticated threat actor. Following additional analysis, it was revealed that the group is an initial access broker that utilizes large-scale phishing operations to infiltrate specific corporate networks and subsequently sells access to those networks to ransomware groups such as Conti and Diavol gangs.

The group starts by producing fake social media profiles, including LinkedIn profiles, by exploiting readily available employee data to make the illicit clones look genuine using advanced A.I. imaging technology. When it was originally discovered, the malware was in the form of a document file that attempted to attack the CVE-2021-40444 vulnerability. Subsequently, the threat actor switched to ISO archives having BazarLoader DLLs with LNK shortcuts.

Currently, the group continued to utilize ISO files but added a DLL containing a new loader, an enhanced form of the prior first-stage loader. The loader injects a malware strain known as “Bumblebee,” which uses WMI to capture system information and exfiltrate it to the C2. Bumblebee may also receive remote actors such as Conti and Diavol orders and download and perform extra payloads.

The Mitre TTPs used by Exotic Lily are:
TA0001 – Initial Access
TA0002 – Execution
TA0004 – Privilege Escalation
TA0010 – Exfiltration
T1566: Phishing
T1566.001: Phishing: Spearphishing Attachment
T1204.002: User Execution: Malicious File
T1047: Windows Management Instrumentation
T1068: Exploitation for Privilege Escalation
T1041: Exfiltration Over C2 Channel