Water Galura

ACTIVE CAMPAIGN TRACKED ⚠ Critical Threat Russia

Primary Aliases: Agenda ArmCorp G1050 G1058

Sponsor / State Affiliation Criminal organization

Primary Motivation Financial gain through double-extortion ransomware operations.

Confidence Rating 95% (Grounded)

Qilin/Agenda Infrastructure Expansion, Systematic Backup & Virtualization Targeting

🎯 Target Sectors & Focus

Healthcare Government Education Manufacturing Legal & Professional Services Financial Services Critical Infrastructure

🛡️ MITRE ATT&CK® Attack Lifecycle (10 TTPs)

📥 Download Navigator JSON

Initial Access 1

T1566 Exploitation of Remote Access Services (VPN, RDP)

Execution 2

T1059 Cross-platform execution (Linux variants on Windows systems)

T1059 Living off the Land (RMM tools, PowerShell, PsExec)

Defense Evasion 1

T1027 Bring Your Own Vulnerable Driver (BYOVD)

Credential Access & Discovery 1

T1003 Credential theft and Dark Web acquisition

Command & Control 1

T1071 Data exfiltration via Cyberduck

Exfiltration & Impact 2

T1485 Double Extortion

T1485 Ransomware-as-a-Service (RaaS)

Operational Techniques 2

T1000 Targeting of Virtualization Environments (VMware ESXi, vCenter)

T1000 Targeting of Backup Infrastructure (Veeam)

Copied to clipboard

LINK COPIED TO CLIPBOARD