An initial access threat actor working in unison with the Conti ransomware gang has been outed by security researchers this week, linking the user to multiple ransomware strains and affiliates. Code named Exotic Lily, this threat actor is seen as one of the digital world’s pristine locksmiths, compromising targets so that a threat organization can exploit that compromise or sell the access to the highest bidder. Exotic Lily in particular seems to favor Russian threat groups and ransomware strains, with significant attribution and involvement with Diavol and Conti ransomware strains; linking to threat organizations such as Conti and Wizard Spider. Tactics utilized by Exotic Lily include rogue email accounts where they would push out sophisticated social engineering lures to capture their target(s). Primarily, Exotic Lily’s favorite industries to target were IT, cybersecurity, and healthcare organizations/service providers but has changed course since November 2021. Lastly, this threat actor relied significantly on file-sharing services such as WeTransfer, OneDrive, TransferNow, and similar applications to deploy malicious payloads, including BazaarBackdoor deployments. CTIX continues to monitor threat actors throughout the landscape and will provide updates accordingly.