Ransomware.live: bqtlock

Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us

| RaaS

BQTLock is a ransomware-as-a-service operation that emerged in 2025, using AES-256/RSA-4096 encryption with Monero payment demands, linked to pro-Palestinian hacktivist networks and targeting organizations with wave-based campaigns with 48-hour ransom deadlines.

Victims

First Victim

2025-07-31

(est. attack date)

Discovery Date

2025-07-31

Last Seen

2025-10-11

Inactive Since

328

days

Avg Delay

N/A

attack→claim

Infostealer

20.0%

victims with domain

Countries

hit

Uptime

0.0% avg (30d)

View Victims on World Map View Group Statistics

Attack Velocity — Last 12 months (based on attack estimated date if available)

Known Locations (1)

Favicon	Title	Type	Available	Last Visit	Server Info	FQDN	Status
	BQTlock :: RaaS & Decryption Portal		No	2026-08-22T08:48:13		`yywhylvqeqynzik6ibocb53o2nat7lmzn5ynjpar3stndzcgmy6dkgid.onion`

Target

Heatmap

YARA Rules (1)

Indicators of Compromise (IoCs) (7)

Telegram 5 Twitter 1 XMR Wallet 1

Type	IOC
`Telegram`	`https://t.me/BQTlock`
`Telegram`	`https://t.me/BQTlock_raas`
`Telegram`	`https://t.me/Fuch0u`
`Telegram`	`https://t.me/ZeroDayX1`
`Telegram`	`https://t.me/liwaamohammad`
`Twitter`	`https://x.com/zerodayx1`
`XMR Wallet`	`89RQN2EUmiX6vL7nTv3viqUAgbDpN4ab329zPCEgbceQJuS233uye4eXtYk3MXAtVoKNMmzgVrxXphLZbJPtearY7QVuApr`