EXOTIC LILY
IntrusionSet · ATTACK:enterprise:G1011
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G1011",
"title": "EXOTIC LILY",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G1011",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--129f2f77-1ab2-4c35-bd5e-21260cee92af",
"external_id": "G1011",
"domain": "enterprise",
"created": "2022-08-18T15:25:59.689Z",
"modified": "2026-07-31T18:47:37.990Z",
"version": "1.0",
"aliases": [
"EXOTIC LILY"
],
"tactics": [
],
"source_references": [
{
"source_name": "Google EXOTIC LILY March 2022",
"url": "https://blog.google/threat-analysis-group/exposing-initial-access-broker-ties-conti/"
}
]
}Explicit source assertions (17)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:S0534
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0277787b-6419-4371-aa5d-77b2d0cc025f
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--25527270-616e-4c53-a85a-03fc0b1e9a96
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1585.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4269e5cb-b2ad-4757-b0b0-bfd5e8b7dc38
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4ae86603-3199-4692-b37c-f26a7c7e3fc2
Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1203
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4f195e59-5f23-45d9-b48e-d0d0a0152b72
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6f23e808-aa3b-4ad8-b932-e294c8921fdb
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--736856d1-3ae3-4135-9dd4-7dfa6b55715b
Proofpoint Bumblebee April 2022 · Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1585.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--88d72a6e-091f-48ff-9ad4-fd05d748d956
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9094f15c-c60c-4366-8c1b-22f21e1156b8
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1594
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--93450717-845e-4cd8-b1ac-3a842251a331
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--988fda8d-8374-4ff7-b70c-f2a654442808
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1597
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a42c4b1f-e145-4bf2-bd5e-fe65ff3e1a24
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:S1039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b2a03f9f-883b-4ced-b4a2-cd49d8e7a3aa
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1583.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b73144e0-3101-4631-9bdc-4e74a9a7d278
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1593.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c854c48c-f9b0-4e41-904d-df7fe6700e7f
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1589.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cbf49a08-de8a-483a-9732-230f9cc93002
Google EXOTIC LILY March 2022ATTACK:enterprise:G1011 → uses → ATTACK:enterprise:T1608.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db393f5e-8029-423c-bfbc-da48fc932cb0
Google EXOTIC LILY March 2022