Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · Water Galura · Unknown · mitre-attack · refreshed 2026-10-06

Water Galura

  • GOLD FEATHER

MITRE G1050 ↗

Water Galura — ATT&CK roseWG

attack rose · 3 techniques across 2 tactics

Analyst brief

mitre-attack

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

3 techniques · 2 of 15 tactics

  1. Resource development

    1 technique

  2. Impact

    2 techniques

select a technique

Arsenal

1 malware · 1 tools
Malware
Malware · 1ATT&CK
QilinS1242 ↗
Tools
Tools · 1ATT&CK
TorS0183 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

3 sources
  1. 1.attack.mitre.org/groups/G1050
  2. 2.news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by…
  3. 3.blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html

Track Water Galura on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.