Water Galura
[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)
Properties
- stix_id
- intrusion-set--be8847e0-9512-45db-895e-f871ab6d3820
- signal_observed_at
- 2026-09-11T17:55:00+00:00
- type
- intrusion-set
MITRE ATT&CK Techniques (3)
Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own fina
Adversaries may create and cultivate social media accounts that can be used during targeting. Adversaries can create social media accounts that can be
Software & Tools (2)
[Qilin](https://attack.mitre.org/software/S1242) is a ransomware family operated as a ransomware-as-a-service (RaaS) that has been active since at lea
[Tor](https://attack.mitre.org/software/S0183) is a software suite and network that provides increased anonymity on the Internet. It creates a multi-h
Explore this actor's full graph with Ninja Signal