自动化接入 · API / MCP EN

组织档案 · G1050

Water Galura

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.

ATT&CK G1050 置信带 高 · 100 来源 src_mitre_attck_enterprise 状态 active
全部2025

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.12

  1. BushidoToken Qilin RaaS JUN 2024
  2. Sophos Qilin MSP APR 2025

断言与引用

每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。

predicateobject有效期置信证据
also_known_asWater Galura— → …100src_mitre_attck_enterprise
also_known_asGOLD FEATHER— → …100src_mitre_attck_enterprise
uses_techniquetech_t1585.0012025 → …100src_mitre_attck_enterprise
uses_techniquetech_t14862025 → …100src_mitre_attck_enterprise
uses_techniquetech_t16572025 → …100src_mitre_attck_enterprise

技术使用

ATT&CK技术platforms
T1486Data Encrypted for Impact—
T1585.001Social Media Accounts—
T1657Financial Theft—

别名

GOLD FEATHER · Water Galura

读取与复核

记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。

纠错