Water Galura

IntrusionSet · ATTACK:enterprise:G1050

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1050",
  "title": "Water Galura",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1050",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--be8847e0-9512-45db-895e-f871ab6d3820",
  "external_id": "G1050",
  "domain": "enterprise",
  "created": "2025-09-29T20:01:50.272Z",
  "modified": "2026-07-31T18:48:14.500Z",
  "version": "1.0",
  "aliases": [
    "Water Galura",
    "GOLD FEATHER"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "GOLD FEATHER"
    },
    {
      "source_name": "Sophos Qilin MSP APR 2025",
      "url": "https://news.sophos.com/en-us/2025/04/01/sophos-mdr-tracks-ongoing-campaign-by-qilin-affiliates-targeting-screenconnect/"
    },
    {
      "source_name": "BushidoToken Qilin RaaS JUN 2024",
      "url": "https://blog.bushidotoken.net/2024/06/tracking-adversaries-qilin-raas.html"
    }
  ]
}

Explicit source assertions (5)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.