Skip to content
Ransomware group

BQTLock

BQTLock is a ransomware/Ransomware-as-a-Service (RaaS) operation referenced as a new ransomware strain active in 2025 and reported to have multiple variants and names.

Profile source: Mallory opens in a new tab

BQTLock

Family profile

BQTLock is a ransomware/Ransomware-as-a-Service (RaaS) operation referenced as a new ransomware strain active in 2025 and reported to have multiple variants and names. The malware is associated with the pro-Palestinian hacktivist group zerodayx1, which launched BQTLock as a RaaS offering. Reporting explicitly describes this as a pivot combining ideological messaging with subscription-based extortion, reflecting a blend of hacktivism and financially motivated ransomware activity. Mentioned coverage includes research on BQTLOCK ransomware and its variants, and analysis comparing BQTLock with another new strain, GREENBLOOD. The available content does not provide technical details on encryption routines, specific infection vectors, targeted operating systems, victimology, or concrete indicators of compromise beyond the association with zerodayx1 and its positioning as a ransomware/RaaS operation.

Ransomware.live

Operational record

View group record ↗

Ransomware.live

Published indicators

Full source record ↗

Twitter

1 total
  • https://x.com/zerodayx1

Telegram

5 total
  • https://t.me/BQTlock
  • https://t.me/liwaamohammad
  • https://t.me/ZeroDayX1
  • https://t.me/BQTlock_raas
  • https://t.me/Fuch0u

Xmr

1 total
  • 89RQN2EUmiX6vL7nTv3viqUAgbDpN4ab329zPCEgbceQJuS233uye4eXtYk3MXAtVoKNMmzgVrxXphLZbJPtearY7QVuApr

Exploited software

Vulnerabilities linked to BQTLock

1 CVEs

MITRE ATT&CK

BQTLock in ATT&CK

8 distinct techniques

Reporting

Research mentioning BQTLock

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.