CVE Intelligence
Home / Threat actors / Water Galura

Water Galura G1050

🔔 Create alert

Also known as: GOLD FEATHER

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

0
associated CVEs
3
Techniques
2
Malware and tools

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.

Ransomware operations linked to this group ransomware.live

qilin via Qilin

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

ATT&CK does not cite CVEs for this group.

Techniques by tactic

Resource Development
T1585.001 Social Media Accounts
Impact
T1486 Data Encrypted for ImpactT1657 Financial Theft

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.