Cyber Resilience

Threat actor · all actors

Water GaluraG1050 unknown

aka Water Galura, GOLD FEATHER

Last updated: 2026-08-20

0attributed CVEs
4ATT&CK techniques
0.0IDF score (tooling uniqueness)
0exclusive CVEs
—years active

About this actor

[Water Galura](https://attack.mitre.org/groups/G1050) are the operators of the [Qilin](https://attack.mitre.org/software/S1242) Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for [Qilin](https://attack.mitre.org/software/S1242) affilates recruited on Russian cybercrime forums. [Water Galura](https://attack.mitre.org/groups/G1050) have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)

Source: MITRE ATT&CK

Names & naming systems

Each vendor coins its own name for the same actor. Where a name follows a known scheme we attribute it; the rest are listed honestly as unclassified.

MITRE ATT&CKG-number catalogue id

G1050

Secureworkscolour-metal names

GOLD FEATHER

Unclassifiedno scheme matched

Water Galura

How we know this

Data origin
MITRE ATT&CK Imported from the MITRE ATT&CK STIX bundle as an intrusion-set object.
Techniques
MITRE ATT&CK STIX mappings — 4 ATT&CK techniques on file.
Named victims
None on file.

Thin data: Only 4 ATT&CK techniques mapped — a thin behavioural profile; absence is not evidence of a narrow toolkit.

See how actor data is built for the full pipeline.

Activity timeline

No activity events recorded.

Profile

CVERiskCVSSEPSSPublishedProducts
No attributed CVEs.

Mitigating controls (NIST 800-53)

ControlTechniques coveredCoverage
AC-62 / 450%
AC-31 / 425%
AC-51 / 425%
CM-21 / 425%
CP-101 / 425%
CP-21 / 425%
CP-61 / 425%
CP-71 / 425%
CP-91 / 425%
SI-31 / 425%
SI-41 / 425%
SI-71 / 425%

Co-occurring actors

None.

Similar actors

Similar TTPs