Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.12
- BushidoToken Qilin RaaS JUN 2024
- Sophos Qilin MSP APR 2025
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | Water Galura | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | GOLD FEATHER | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1585.001 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2025 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2025 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1486 | Data Encrypted for Impact | — |
| T1585.001 | Social Media Accounts | — |
| T1657 | Financial Theft | — |
Aliases
GOLD FEATHER · Water Galura
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.