Overview 

Water Galura is the group that runs the Qilin ransomware-as-a-service (RaaS) operation. It doesn’t usually carry out break-ins itself. Instead, it acts as the back office for a network of Qilin affiliates, whom it recruits on Russian-language cybercrime forums. Water Galura builds the ransomware payloads, handles negotiations with victims, and publishes stolen data when victims refuse to pay. 

The group has been active since at least 2022 and relies on a double-extortion model: victims are pressured both to buy a decryption key and to keep their stolen data off a public leak site. 

Because affiliates do the hands-on intrusion work, the attacks that carry Water Galura’s ransomware vary in technique. One documented approach stands out. Affiliates have spear-phished administrators of ScreenConnect instances at managed service providers (MSPs), using that access to reach the MSPs’ downstream customers. A single compromised MSP admin can therefore expose many client organizations at once. 

Operating Model 

Water Galura’s role divides into three core functions: 

• Payload generation: Produces the Qilin ransomware builds that affiliates deploy on victim networks. 

• Ransom negotiation: Manages communications with victims and pushes for payment. 

• Data publication: Posts exfiltrated data on its Tor-based leak site when victims don’t pay. 

Affiliates supply the access and execution, and Water Galura supplies the tooling and the extortion infrastructure behind them. This split lets the operation scale well beyond what a single crew could manage. The group also runs a Telegram news channel, which it uses to make announcements about the Qilin RaaS. 

Targeting and Reach 

Water Galura’s activity spans 100 countries across every inhabited continent and 25 distinct industries. This breadth is typical of a RaaS model, where many independent affiliates pick their own targets based on whatever access they can obtain. 

The country list includes Russia and Ukraine. Many Russian-speaking ransomware operations explicitly steer clear of these countries, so their presence here is worth noting. 

The group’s targeting spans 100 countries across six regions. In North America and the Caribbean, 12 countries have been affected: the United States, Canada, Mexico, Puerto Rico, Antigua and Barbuda, Aruba, Barbados, Curaçao, the Dominican Republic, Grenada, Jamaica, and Trinidad and Tobago. Central and South America account for another 13: Costa Rica, Guatemala, Honduras, Panama, Argentina, Bolivia, Brazil, Chile, Colombia, Ecuador, Paraguay, Peru, and Venezuela. 

Europe is the most heavily represented region, with 33 countries: Austria, Belgium, Bosnia and Herzegovina, Croatia, Cyprus, the Czech Republic, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Ireland, Italy, Luxembourg, Malta, the Netherlands, North Macedonia, Norway, Poland, Portugal, Romania, Russia, Serbia, Slovakia, Slovenia, Spain, Sweden, Switzerland, Turkey, Ukraine, and the United Kingdom. 

In the Middle East, eight countries appear on the list: the United Arab Emirates, Israel, Jordan, Kuwait, Lebanon, Oman, Qatar, and Saudi Arabia. Africa accounts for 15: Angola, the Democratic Republic of the Congo, Egypt, Gabon, Ghana, Kenya, Libya, Madagascar, Mauritius, Morocco, Mozambique, Namibia, South Africa, Tunisia, and Uganda. Finally, 19 countries in the Asia-Pacific region have been targeted: Australia, Bangladesh, China, Fiji, Hong Kong, India, Indonesia, Japan, Malaysia, Myanmar, New Zealand, Pakistan, Palau, the Philippines, Singapore, South Korea, Taiwan, Thailand, and Vietnam. 

The sectoral spread is just as broad, covering 25 industries: aerospace and defense; agriculture and livestock; automotive; banking, financial services and insurance (BFSI); chemicals; construction; consumer goods; education; energy and utilities; food and beverages; government and law enforcement; healthcare; hospitality; IT and IT-enabled services; manufacturing; media and entertainment; metals, minerals and mining; organizations; pharmaceuticals and biotechnology; professional services; real estate; retail; technology; telecommunications; and transportation and logistics. 

The victims range from hospitals and schools to defense contractors and government bodies. Water Galura’s affiliates show no sign of sector discipline; any organization they can get into appears to be fair game. 

Malware and Tooling 

Two families are associated with Water Galura: one ransomware strain and one anonymity tool. 

AgendaCrypt 

AgendaCrypt is ransomware written in the Go programming language. Threat actors have used it in campaigns that exploit security weaknesses in JetBrains TeamCity, the continuous integration and build server. Its use extends beyond file encryption: actors have used it to drop ransomware, cryptocurrency miners, Cobalt Strike beacons and Spark RAT on compromised machines. 

A typical scenario runs as follows. Attackers gain a foothold in a company’s network through a vulnerable TeamCity server. They then use AgendaCrypt to deploy ransomware and demand payment for the decryption keys, leaving the victim with serious operational disruption and financial loss. The exact identity and motives of those behind AgendaCrypt have not been publicly disclosed. 

Tor 

Tor is both a software suite and a network that makes internet activity harder to trace. It routes traffic through several relays and wraps it in multiple layers of encryption. Roger Dingledine, Nick Mathewson and Paul Syverson developed it in 2004, mainly to give users a secure and private way to communicate. 

That same anonymity makes Tor attractive to criminals. Threat actors use it to cover their tracks and make it harder for law enforcement to follow their online activity. For Water Galura, Tor also hosts the data leak site where it publishes stolen information from victims who refuse to pay. 

MITRE ATT&CK Mapping 

• Impact (TA0040) – Data Encrypted for Impact (T1486): Water Galura generates Qilin ransomware payloads that encrypt files across victim networks. 

• Impact (TA0040) – Financial Theft (T1657): Water Galura extorts victims for decryption keys and for the suppression of stolen data that would otherwise appear on its Tor leak site. 

• Resource Development (TA0042) – Social Media Accounts (T1585.001): Water Galura runs a Telegram news channel to post announcements about the Qilin RaaS. 

Conclusion 

Water Galura shows how a RaaS operator can extend its reach without touching most of the networks it profits from. It supplies the payloads, negotiations and leak site, while affiliates recruited from Russian cybercrime forums do the breaking in. Active since at least 2022, the operation has reached 100 countries and 25 industries, with affiliates spear-phishing MSP ScreenConnect administrators to reach entire customer bases at once. 

Because each affiliate brings its own methods, Qilin attacks won’t follow one script. The constants are double extortion, a Tor leak site and the supply-chain risk of MSP remote management tools, so organizations should protect platforms like ScreenConnect as high-value targets. 

Cyble’s threat intelligence monitors underground forums, leak sites and dark web chatter, warning you when your organization or suppliers are being targeted. Book a free demo to get ahead of Qilin and the next RaaS operation aimed at your industry. 

Frequently Asked Questions about Water Galura 

Who is Water Galura? 

 The group behind the Qilin ransomware-as-a-service operation. It generates payloads, negotiates ransoms and publishes stolen data on behalf of Qilin affiliates. 

How long has it been active? 

 Since at least 2022. 

Where do its affiliates come from? 

 Russian cybercrime forums. 

How do Qilin affiliates get in? 

 Methods vary by affiliate. One documented tactic is spear-phishing MSP administrators who manage ScreenConnect, then using that access to reach downstream customers. 

What extortion model does it use? 

 Double extortion: victims are pressed to pay for a decryption key and to stop their stolen data from being published on a Tor leak site. 

What malware is linked to it? 

 AgendaCrypt, a Go-based ransomware, along with the Tor anonymity network as a supporting tool. 

How widespread is it? 

 Its activity covers 100 countries and 25 industries. 

How does it communicate publicly? 

 Through a Telegram news channel used for Qilin RaaS announcements. 

Disclaimer: This profile is compiled from open-source reporting and Cyble’s threat intelligence research as of the date of publication. Details about Water Galura, its affiliates, and the Qilin ransomware operation may change as new information emerges. Victim counts, country and industry figures, and MITRE ATT&CK mappings reflect publicly reported activity and may not be complete. This content is provided for informational purposes only and should not be taken as a definitive attribution or as a substitute for professional security advice.