https://x.com/zerodayx1
BQTLock
BQTLock is a ransomware/Ransomware-as-a-Service (RaaS) operation referenced as a new ransomware strain active in 2025 and reported to have multiple variants and names.
Profile source: Mallory opens in a new tabBQTLock
Family profile
BQTLock is a ransomware/Ransomware-as-a-Service (RaaS) operation referenced as a new ransomware strain active in 2025 and reported to have multiple variants and names. The malware is associated with the pro-Palestinian hacktivist group zerodayx1, which launched BQTLock as a RaaS offering. Reporting explicitly describes this as a pivot combining ideological messaging with subscription-based extortion, reflecting a blend of hacktivism and financially motivated ransomware activity. Mentioned coverage includes research on BQTLOCK ransomware and its variants, and analysis comparing BQTLock with another new strain, GREENBLOOD. The available content does not provide technical details on encryption routines, specific infection vectors, targeted operating systems, victimology, or concrete indicators of compromise beyond the association with zerodayx1 and its positioning as a ransomware/RaaS operation.
Ransomware.live
Operational record
Ransomware.live
Published indicators
Telegram
5 totalhttps://t.me/BQTlockhttps://t.me/liwaamohammadhttps://t.me/ZeroDayX1https://t.me/BQTlock_raashttps://t.me/Fuch0u
Xmr
1 total89RQN2EUmiX6vL7nTv3viqUAgbDpN4ab329zPCEgbceQJuS233uye4eXtYk3MXAtVoKNMmzgVrxXphLZbJPtearY7QVuApr
Exploited software
Vulnerabilities linked to BQTLock
1 CVEsMITRE ATT&CK
BQTLock in ATT&CK
8 distinct techniquesReporting
Research mentioning BQTLock
IcedID malware developer fakes his own death to escape the FBI
ANY.RUN looks at BQTLock & GREENBLOOD, two new ransomware strains that started operations this year.
KrakenLabs Research Highlights 2025: The Shifts That Redefined the Threat Landscape
This shift was illustrated by the pro-Palestinian actor zerodayx1, which launched the BQTLock Ransomware-as-a-Service offering, explicitly combining ideological messaging with subscription-based extortion.
Dragos Industrial Ransomware Analysis: Q3 2025 | Dragos
“Minimal-activity Groups… such as … BQTlock… each registered one incident.”
⚡ Weekly Recap: Oracle 0-Day, BitLocker Bypass, VMScape, WhatsApp Worm & More
A pro-Palestinian hacktivist group known as zerodayx1 launched its own Ransomware-as-a-Service (RaaS) operation called BQTLock, making it the latest group to make such as pivot.
Risky Bulletin: npm attack uses AI prompts to steal creds, crypto-wallet keys
"BQTLOCK ransomware: K7 researchers have published a report on the BQTLOCK ransomware and its multiple variants and names."