Email Threats: Exotic Lily

ReliaQuest Photon investigated targeted phishing by the Initial Access Broker 'Exotic Lily' (aka PROJECTOR LIBRA/TA580) that leverages high-fidelity impersonation, TLD spoofing, and legitimate filesharing platforms to deliver ZIP archives containing ISO/IMG images with LNK shortcuts; these shortcuts have deployed loaders (BumbleBee or a Python-based loader) which in one case loaded a Cobalt Strike beacon before the host was contained. The report details the group's methodology, a recent incident, and recommends heightened user awareness and automated phishing analysis (GreyMatter Phishing Analyzer) to accelerate detection and containment.