Threat actor · all actors

Water GaluraG1050 unknown

aka Water Galura, GOLD FEATHER

Last updated: 2026-07-03

0attributed CVEs

4ATT&CK techniques

0.0IDF score (tooling uniqueness)

0exclusive CVEs

—years active

About this actor

[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)

Source: MITRE ATT&CK

Activity timeline

No activity events recorded.

Profile

CVE	Risk	CVSS	EPSS	Published	Products
No attributed CVEs.

Mitigating controls (NIST 800-53)

Control	Techniques covered	Coverage
`AC-6`	2 / 4	50%
`AC-3`	1 / 4	25%
`AC-5`	1 / 4	25%
`CM-2`	1 / 4	25%
`CP-10`	1 / 4	25%
`CP-2`	1 / 4	25%
`CP-6`	1 / 4	25%
`CP-7`	1 / 4	25%
`CP-9`	1 / 4	25%
`SI-3`	1 / 4	25%
`SI-4`	1 / 4	25%
`SI-7`	1 / 4	25%

Co-occurring actors

None.