Water Galura
Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.
Properties
- Last source
- MITRE ATT&CK
- STIX ID
- intrusion-set--be8847e0-9512-45db-895e-f871ab6d3820
- In Signal since
- initial import (Sep 2026)
- Retrieved at
- 2026-11-02T16:56:30+00:00
- Type
- intrusion-set
MITRE ATT&CK Techniques (3)
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina
Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be
Software & Tools (2)
Qilin is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at lea
Tor is a software suite and network that provides increased anonymity on the Internet. It creates a multi-h
Explore this actor's full graph with Ninja Signal