G1050 Water Galura
Enterprisealso known asWater Galura · GOLD FEATHER
Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.
01
canonical actor
The group this is attributed to.
02
techniques used (3)
ATT&CK techniques this enables or maps to.
03
software used (2)
Malware and tools associated with this.
04
source
Where this definition is published.