G1050 · ATT&CK 19.1 group

Water Galura

[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)

Aliases: GOLD FEATHER, Water Galura

Mapped techniques (3)

T1486T1585.001T1657

Cyber Knowledge routes

These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.

AI red teaming, evaluation, and reproducible security testing
AI Security · topic-matchGovernance, risk, assurance, transparency, and human factors
AI Security · topic-matchIncident declaration, triage, scope, and hypotheses
Digital Forensics & Incident Response (DFIR) · topic-matchPost-incident learning and controlled AI/RAG/MCP assistance
Digital Forensics & Incident Response (DFIR) · topic-matchGovernance, organizational context, and accountable authority
Governance, Risk & Compliance (GRC) · topic-matchScenario-based cyber risk assessment and treatment
Governance, Risk & Compliance (GRC) · topic-matchPrivacy engineering and data governance
Governance, Risk & Compliance (GRC) · topic-matchOperational resilience, continuity, crisis, and incident governance
Governance, Risk & Compliance (GRC) · topic-matchVulnerability handling, remediation, disclosure, and learning
Secure Code & Application Security · topic-matchLinux and macOS endpoint forensics
Digital Forensics & Incident Response (DFIR) · tactic-routePolicy architecture, standards, procedures, and exceptions
Governance, Risk & Compliance (GRC) · tactic-routeModule 6 — Alert triage, investigation, and escalation
Blue Team & Defensive Security · tactic-route