New Threat Actor Exotic Lily acting as Initial Access Broker for Conti and Diavol ransomware group

THREAT LEVEL: Red.

For a detailed advisory, download the pdf file here.

Exotic Lily was first discovered exploiting a zero-day vulnerability in Microsoft MSHTML (CVE-2021-40444), which piqued the curiosity of researchers as a potentially sophisticated threat actor. Following additional analysis, it was revealed that the group is an initial access broker that utilizes large-scale phishing operations to infiltrate specific corporate networks and subsequently sells access to those networks to ransomware groups such as Conti and Diavol gangs.

The group starts by producing fake social media profiles, including LinkedIn profiles, by exploiting readily available employee data to make the illicit clones look genuine using advanced A.I. imaging technology. When it was originally discovered, the malware was in the form of a document file that attempted to attack the CVE-2021-40444 vulnerability. Subsequently, the threat actor switched to ISO archives having BazarLoader DLLs with LNK shortcuts.

Currently, the group continued to utilize ISO files but added a DLL containing a new loader, an enhanced form of the prior first-stage loader. The loader injects a malware strain known as “Bumblebee,” which uses WMI to capture system information and exfiltrate it to the C2. Bumblebee may also receive remote actors such as Conti and Diavol orders and download and perform extra payloads.

The Mitre TTPs used by Exotic Lily are:TA0001 – Initial AccessTA0002 – ExecutionTA0004 – Privilege EscalationTA0010 – ExfiltrationT1566: PhishingT1566.001: Phishing: Spearphishing AttachmentT1204.002: User Execution: Malicious FileT1047: Windows Management InstrumentationT1068: Exploitation for Privilege EscalationT1041: Exfiltration Over C2 Channel

Vulnerability Details

Indicators of Compromise (IoCs)

Patch Link

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444

References

https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/