Forensia CTI Core

Profile

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.

MITRE ATT&CK ↗

Techniques

3 ATT&CK techniques attributed to this actor.

T1486 Data Encrypted for Impact T1585.001 Social Media Accounts T1657 Financial Theft

Software

2 malware/tools attributed to this actor.

TorQilin

Related corpus activity

744 indicators EXHIBIT techniques this actor uses. This is a shared-technique signal, not a first-party attribution to Water Galura.

Indicator	Type	Family	Sev	Src
cve-2025-34054	cve	—	85	4
cve-2021-27137	cve	—	85	8
cve-2025-1055	cve	ransomware	85	3
cve-2026-4368	cve	ransomware	85	1
cve-2016-15047	cve	—	85	4
cve-2025-61155	cve	ransomware	85	3
cve-2023-44976	cve	ransomware	85	2
cve-2023-52271	cve	ransomware	85	3
6190923b28679eb8230010aff9b1d1a4184e8697540cc021a5be38126f3f6d99	hash	ransomware	80	2
16474e9e4773fbc1e0b48a5025fad31b7f084b1beffb9a42687b4d01979885fe	hash	ransomware	80	2
2528df60e55f210a6396dd7740d76afe30d5e9e8684a5b8a02a63bdcb5041bfc	hash	ransomware	80	2
f0b3e112ce4807a28e2b5d66a840ed7f	hash	ransomware	80	2
4e4a3751581252e210f6f45881d778d1f482146f92dc790504bfbcd2bdfa0129	hash	ransomware	80	2
64a0ab00d90682b1807c5d7da1a4ae67cde4c5757fc7d995d8f126f0ec8ae983	hash	ransomware	80	2
72bed9b26a7747252156b65d24a9a737d70b9bf6aca069c514c1c7b9e04ef9b6	hash	ransomware	80	2
3e62797fd746ce9bd5d49cb833b7d9ac62d6b7a2	hash	ransomware	80	2
28a9982cf2b4fc53a1545b6ed0d0c1788ca9369a847750f5652ffa0ca7f7b7d3	hash	ransomware	80	2
8bd16897409ae5d5667c345276d2532f493c0f98	hash	ransomware	80	2
0b1870d57221eec6f3bbef648e71a724	hash	ransomware	80	2
f962e15c6efebb3c29fe399bb168066042b616affddd83f72570c979184ec55c	hash	ransomware	80	2
259fd28f9e66159d5a30b86688fec184	hash	ransomware	80	2
42a99a5effdc1d02f6b622537de881e1	hash	ransomware	80	2
eead44c0af7ddb12cece1a6125cf213bab3c22511cd59aff9d63dcfddb7d4386	hash	—	80	4
54a6743781fd4ceb720331fce92f16186931192d	hash	ransomware	80	2
b0e292346b4ab3f83fadd8abcce7cfc5b9d50ef73ad141e8bc4a4689fee13504	hash	ransomware	80	2
686213cc11d36af764de824801bced9366dfca3823fe0d51b752f74149bcf1f4	sha256	ransomware	80	1
edbf152ed9ac79e5d9e0111d1071af48	hash	ransomware	80	2
43f4ca1c7474c0476a42d937dc4af01c8ccfc20331baa0465ac0f3408f52b2e2	hash	ransomware	80	2
b0cfa2089802634ffb8c77962cdb18317a6332d4	hash	ransomware	80	2
7890b116d13a52efe696ce1e2c0ed83029775cf4bea836ce551e71d222ee116f	hash	ransomware	80	2

Showing the top 30 by severity of 744.