Water Galura

Also known as: GOLD FEATHER

Overview

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.

Naming & attribution

Water Galura is tracked under 2 names across the industry. It uses 3 documented ATT&CK techniques — more than 8% of the 174 groups tracked here. Activity attributed since at least 2022.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
GOLD FEATHER	Thomas, W

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

Medusa Group — 3 shared techniques (5% overlap)
Scattered Spider — 3 shared techniques (5% overlap)
VOID MANTICORE Iran — 3 shared techniques (5% overlap)

Malware families with tracked indicators

One family attributed to Water Galura, with 4 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-09-26). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

Qilin 4 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

TTPs — 3 techniques across 2 tactics

Resource Development

T1585.001 Social Media Accounts

Impact

T1486 Data Encrypted for Impact
T1657 Financial Theft

Tools & malware (2)

Qilin · Tor

Reporting (2)

Qilin affiliates spear-phish MSP ScreenConnect admin, targeting customers downstream — Bradshaw, A. et al
Tracking Adversaries: The Qilin RaaS — Thomas, W