EXOTIC LILY’s attack chain has remained relatively consistent throughout the time we’ve been tracking the group: One notable technique is the use of domain and identity spoofing as a way of gaining additional credibility with a targeted organization.