Google EXOTIC LILY March 2022

Bumblebee has the ability to identify the user name.

Bumblebee can send collected data in JSON format to C2.

Bumblebee can use WMI to gather system information and to spawn processes for code injection.

Bumblebee can use `cmd.exe` to drop and run files.

Bumblebee can enumerate the OS version and domain on a targeted system.

EXOTIC LILY has used file-sharing services including WeTransfer, TransferNow, and OneDrive to deliver payloads.

Bumblebee can download and execute additional payloads including through the use of a `Dex` command.

EXOTIC LILY has used malicious documents containing exploits for CVE-2021-40444 affecting Microsoft MSHTML.

EXOTIC LILY has used malicious links to lure users into executing malicious payloads.

EXOTIC LILY has gained execution through victims clicking on malicious LNK files contained within ISO files, which can execute hidden DLLs within the ISO.

EXOTIC LILY conducted an e-mail thread-hijacking campaign with malicious ISO attachments.

EXOTIC LILY has relied on victims to open malicious links in e-mails for execution.

EXOTIC LILY has used the e-mail notification features of legitimate file sharing services for spearphishing.

EXOTIC LILY has registered domains to spoof targeted organizations by changing the top-level domain (TLD) to “.us”, “.co” or “.biz”.

EXOTIC LILY has established social media profiles to mimic employees of targeted companies.

EXOTIC LILY has created e-mail accounts to spoof targeted organizations.

EXOTIC LILY has gathered targeted individuals' e-mail addresses through open source research and website contact forms.

EXOTIC LILY has copied data from social media sites to impersonate targeted individuals.

EXOTIC LILY has used contact forms on victim websites to generate phishing e-mails.

EXOTIC LILY has searched for information on targeted individuals on business databases including RocketReach and CrunchBase.

EXOTIC LILY has uploaded malicious payloads to file-sharing services including TransferNow, TransferXL, WeTransfer, and OneDrive.