Trusted Design

Water Galura

アクターID: G1050

· MITRE Pageへのリンク

脅威アクターの詳細

Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen data for Qilin affilates recruited on Russian cybercrime forums. Water Galura have been active since at least 2022 and use a double extortion model where they demand payment for providing decryption keys and for refraining from publishing the stolen data to their leak site.(Citation: BushidoToken Qilin RaaS JUN 2024)(Citation: Sophos Qilin MSP APR 2025)

脅威アクターの別名・別称

Water Galura
GOLD FEATHER

利用した攻撃手法

• T1552.003 - Shell History
• T1565 - Data Manipulation
• T1027 - Obfuscated Files or Information

関連するCVE (攻撃手法に関連)

• CVE-2014-4114 (T1027)
• CVE-2015-5119 (T1027)
• CVE-2015-5122 (T1027)
• CVE-2015-1427 (T1027)
• CVE-2012-1856 (T1027)
• CVE-2015-2546 (T1027)
• CVE-2014-6332 (T1027)
• CVE-2015-3785 (T1027)
• CVE-2015-7645 (T1027)
• CVE-2017-12149 (T1027)
• CVE-2015-3043 (T1027)
• CVE-2015-3456 (T1027)
• CVE-2015-3090 (T1027)
• CVE-2010-1553 (T1027)
• CVE-2015-3113 (T1027)
• CVE-2015-2424 (T1027)
• CVE-2015-0097 (T1027)
• CVE-2015-4495 (T1027)
• CVE-2012-0158 (T1027)
• CVE-2014-6271 (T1027)
• CVE-2013-2094 (T1027)
• CVE-2014-4113 (T1027)
• CVE-2016-1010 (T1027)
• CVE-2016-1019 (T1027)
• CVE-2016-0984 (T1027)
• CVE-2016-1001 (T1027)
• CVE-2016-0998 (T1027)
• CVE-2015-0313 (T1027)
• CVE-2015-0359 (T1027)
• CVE-2014-0329 (T1027)
• CVE-2015-5130 (T1027)
• CVE-2015-5134 (T1027)
• CVE-2015-5539 (T1027)
• CVE-2015-5557 (T1027)
• CVE-2015-5563 (T1027)
• CVE-2015-5559 (T1027)
• CVE-2015-5540 (T1027)
• CVE-2015-5561 (T1027)
• CVE-2015-5551 (T1027)
• CVE-2015-5564 (T1027)
• CVE-2015-5565 (T1027)
• CVE-2015-5550 (T1027)
• CVE-2015-5566 (T1027)
• CVE-2015-5127 (T1027)
• CVE-2015-5556 (T1027)
• CVE-2015-5749 (T1027)
• CVE-2015-3628 (T1027)
• CVE-2015-2852 (T1027)
• CVE-2015-2854 (T1027)
• CVE-2015-2853 (T1027)
• CVE-2015-7755 (T1027)
• CVE-2012-4969 (T1027)
• CVE-2016-1287 (T1027)
• CVE-2016-2343 (T1027)
• CVE-2017-0263 (T1027)
• CVE-2017-0261 (T1027)
• CVE-2017-0262 (T1027)
• CVE-2016-9494 (T1027)
• CVE-2016-9496 (T1027)
• CVE-2016-9495 (T1027)
• CVE-2025-55182 (T1027)
• CVE-2015-0311 (T1027)
• CVE-2013-3906 (T1027)
• CVE-2014-6352 (T1027)
• CVE-2015-0016 (T1027)
• CVE-2012-0056 (T1027)
• CVE-2010-3081 (T1027)
• CVE-2010-3333 (T1027)
• CVE-2012-3213 (T1027)
• CVE-2014-0322 (T1027)
• CVE-2012-1258 (T1027)
• CVE-2015-0336 (T1027)
• CVE-2011-3544 (T1027)
• CVE-2014-7911 (T1027)
• CVE-2014-4322 (T1027)
• CVE-2013-6282 (T1027)
• CVE-2015-3105 (T1027)
• CVE-2014-0497 (T1027)
• CVE-2017-16929 (T1027)
• CVE-2017-17215 (T1027)
• CVE-2013-0074 (T1027)
• CVE-2012-0507 (T1027)
• CVE-2013-2465 (T1027)
• CVE-2014-8439 (T1027)
• CVE-2013-2551 (T1027)
• CVE-2010-0188 (T1027)
• CVE-2014-0569 (T1027)
• CVE-2014-0515 (T1027)
• CVE-2015-0310 (T1027)
• CVE-2012-4681 (T1027)
• CVE-2014-1776 (T1027)
• CVE-2014-0556 (T1027)
• CVE-2012-1876 (T1027)
• CVE-2015-5560 (T1027)
• CVE-2015-0057 (T1027)
• CVE-2014-9163 (T1027)
• CVE-2012-1723 (T1027)
• CVE-2014-8440 (T1027)
• CVE-2010-0806 (T1027)
• CVE-2010-1297 (T1027)
• CVE-2010-2884 (T1027)
• CVE-2013-7331 (T1027)
• CVE-2015-2360 (T1027)
• CVE-2014-4148 (T1027)
• CVE-2011-3402 (T1027)
• CVE-2014-6324 (T1027)
• CVE-2010-2883 (T1027)
• CVE-2013-0634 (T1027)
• CVE-2014-7247 (T1027)
• CVE-2012-5054 (T1027)
• CVE-2013-2678 (T1027)
• CVE-2010-0738 (T1027)
• CVE-2015-2426 (T1027)
• CVE-2008-1436 (T1027)
• CVE-2010-0232 (T1027)
• CVE-2010-4398 (T1027)
• CVE-2013-0641 (T1027)
• CVE-2013-0640 (T1027)
• CVE-2014-3393 (T1027)
• CVE-2012-6422 (T1027)
• CVE-2013-2595 (T1027)
• CVE-2014-3897 (T1027)
• CVE-2015-2387 (T1027)
• CVE-2009-3129 (T1027)
• CVE-2010-2572 (T1027)
• CVE-2011-0611 (T1027)
• CVE-2013-5990 (T1027)
• CVE-2015-2419 (T1027)
• CVE-2016-0189 (T1027)
• CVE-2016-4117 (T1027)
• CVE-2017-0001 (T1027)
• CVE-2017-7255 (T1027)
• CVE-2017-0143 (T1027)
• CVE-2023-1389 (T1027)
• CVE-2025-13335 (T1027)
• CVE-2025-13927 (T1027)
• CVE-2025-13928 (T1027)
• CVE-2025-24893 (T1027)
• CVE-2025-31125 (T1027)
• CVE-2025-34026 (T1027)
• CVE-2025-55183 (T1027)
• CVE-2025-55184 (T1027)
• CVE-2025-68645 (T1027)
• CVE-2026-0723 (T1027)
• CVE-2026-1102 (T1027)
• CVE-2026-20127 (T1027)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る