{
  "id": "water-galura",
  "name": "Water Galura",
  "aliases": [
    "GOLD FEATHER"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Operators of Qilin ransomware-as-a-service",
      "src": [
        "mitre-g1050"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2022,
      "src": [
        "mitre-g1050"
      ],
      "conf": "medium",
      "note": "At least 2022"
    },
    {
      "k": "attack_id",
      "v": "G1050",
      "src": [
        "mitre-g1050"
      ],
      "conf": "high"
    },
    {
      "k": "techniques_count",
      "v": 3,
      "src": [
        "mitre-g1050"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "Qilin, Tor",
      "src": [
        "mitre-g1050"
      ],
      "conf": "high",
      "note": "2 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G1050)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/water-galura.html",
  "sources": {
    "mitre-g1050": {
      "title": "Water Galura, Group G1050",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G1050/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}