bqtlock Ransomware Group
Ransomware group profile
9Victims
UnknownSource country
74Impact score
Also Known As
BAQIYATLock
Liwaa Mohammad
BQTLock
BQT Ransomware
bqtlock
Description
BQTLock, also known as Baqiyatlock313, is a ransomware group that emerged in July 2025, utilizing a Ransomware-as-a-Service model. Despite its pro-Palestinian messaging, the group's primary motive is financial gain, targeting various sectors through phishing and exploiting vulnerable systems.
Key insights
- •Operates under a Ransomware-as-a-Service model with tiered affiliate access.
- •Targets healthcare, manufacturing, and professional services sectors.
- •Employs double extortion techniques, threatening data publication if ransoms are unpaid.
- •Utilizes a hybrid AES-256 and RSA-4096 encryption scheme for file encryption.
- •Gains initial access through phishing, exposed RDPs, and vulnerable software.
Threat Level & Status Breakdown
For bqtlock · Based on incidents in selected period
1.5threat level
Aggressiveness2.3/ 10
Lethality0/ 10
Criticality2.4/ 10
Status Breakdown
Negotiating11.1%1
Claimed88.9%8
First seenAug 2025
Last seenApr 2026
Avg ransom—
Payment rate—
Statusactive
Sophistication0
Last updatedAug 8, 2026
Recent activity
Monthly attack count for bqtlock in the selected period
9Total attacks
4peak in Dec
1.8avg / month
Intelligence
IOCs, YARA/Sigma rules, and related families for bqtlock
- 4e7434ac13001fe55474573aa5e9379d
- 862f29aa00bb4ee33729bc6699990dbdf9ef890b8364f8288b173cb1ca5d6787
- 618070d597dd73c43ba5d4bde2baa93a4f6038e3279de3bafe688caa5c409a58
- 49f89b2fdef345a9d92fc821e4a226d8ac99e4ca0d2d11b5654f6557800b85f2
- 53385e0fd7fc9c88080abf5b97cd5b84b31c876e
- 881b048234ebed82339244eb0c18580d785944dc82f83949f6adc1a9bc225c3b
- f77c203d0c80598954c06a0f6f0c46f8b885ba423d12a21f13ded0168aa11b10
- 4369aed581de0fe84c25a1ef2c3cf0bb6bf70df8b51fdf38b3b0b2a55f43261b
- 324eabc27a25f524c94bb62573986b3335ab5181ddc6825d959d16aaaccdc7aa
- 9547933dd46501af7fc095a3513e48b81178e344b86e075b679259875f0fd5a7
- af90666822646e35eb52248f4a89eb715ce9f44459205bc24827a2aafe053548
- 058a1dbfa03cac6cc67d34a4dcc69445
- 10938c2d01dc999d2fe1f8c635e3705e7e663077935a17e730c849d1191c76ed
- caef2db273f466df3e2fa8c61bca6f9d58c99057
- cd5e7b3b59cea14b804f6c01821d1ab94a0046422fe956f623b238c5db0cac99
- fbd67a3bcc964e370931f620a85bf368d7b5797ebc1d53fe3be11a89a90e7961
- 56eec59a5fe3f5a3c2c836701557bf1956770f465cd9e049995b86aef76a3e39
- 590e47944ef0597bf1ff1d41656859b776e7031a4611cbf22d619002cbe49312
- 97524f4c582e0fbe46b74a7cfe4db9f078f368520cda25f27a50c5d2c50161f9
- 5b992a3438e344dddcdd66151a40efb3452b2ff37cdc40b37db612afeb29ed29
- b61ae633616d7dd29aaf0b170fdfbe8f282c0f8bdcb1c52aedee473ce4bf5789
- e2622ede1ebe5a37c439a32f0c63c13f893d1e5513b27367502898651cc5464b
- 110df49522d46b612a28bafbdff3405c
- 0ccd3f2d7e6637eaf5414e35b97d9d8bf6b8e4182859cace8ca8e02377a4e62a
- 4b4d6e2ffbbc2f2e13202125cbff097b2eedd654
- 780e34c72404fd464669626ae554b81393d2bae95293284b375bb5d989914486
- dacbba7f18d0835deb2eeb4e4d82c8f57234767291a90da1a5f3fd02d6bc13c2
- 008ec0226066572f4b27f100d08443120b9dd55cefbec2bbff994b5b552e546c
- 9323fca75a86c75ffbdcc88ed8f35e5a
- a6a397fec6c109a1402c6f1144d647843b2093f65fedd27204b40ebeea0640b6
- 00005ed250d85fc47e4c3883b8e6179a9888b8140acfeb94a40edc36bd523adb
- 4f935fd188b1e9965e083f72ec33712dae53409a
- 1859f56847ccabc6581a56f55041955f
- d244b63e40aab7299d194c11bf060054
- b7796a3b1812f329c43d5d37bbb6d8032b7bc06b15af29f555eb3e0c7b1b1c3d
- 425b2f283b71237276f84d941d9c2982c7f61a9aff12ece10e15065b73b7165e
- 5531198fdd7c3691be3b0bb2e449dafa29620c85
- b211537ea626fae4ad2ef5ee2652633dc68aaf20da6eb953a44f266c4106b367
- 7170292337a894ce9a58f5b2176dfefc
- 11affbeb18f4d6edcc9a4be5a82f8e23dfc31178887e97119faa5ddc75990494
- 3c8d106f63d1ed921f9b8c7d103d73cd591fe19c
- d4999a1bd31343ef380147b10c2a185411cd5413
- 9cd62dbace3324487124787127cff7c63a9f005d8d3aff9bac28c437e5caefc7
- f558a0bcd20e01e46551a491c66114e8
- 9600db537e27db88ed2eca3be0ffab35cdb22a86a6dbb048d8deaf8f56944822
- 5befee1210165646b4bb6574663f01ace27c630e
- a18c29c72d1808477727ec2a611cee0f22ecd435457265bcf10823e0980c3636
- ba8291a7d062dcfcdf824399b42eef9f
- 406e6065cac225b47784fb07230962e28abbb6fa
- 67e7b0bf057c8c7ef117be16a168833235920d0af16921ff59d0866f0d05e050
- 16b4f2af4cd1d1e1fd2089d0c0697534
- 3857744a651da4e431083180798041a5e888b09334a1a04c2c047216f471b0f6
- dbc6750d065d4ab641877b630cc7f59866c91183
- 9c58050d0fb79c4863ae6df6aa661d9e
- 2aae1d749353067f5afb5bebedb5249047f60e7aaa9684ac7c779a0908b1573c
- 789c2008899fae1ef90205c72d15dc04803baa1c
- d924b7a24bce868e7b09441269d2925b
- 7ade4d9ca56ead7ff98ff42935313dcb0558f238
- ae57e4be3ebcf78d4f569a3b7875c287d70f7d45876fcaaaebe3f5ca58cce600
- cd4dad081f725dfbfb7a953be2d375e642cb70b31c657855f6acb0b6f1cb0a4f
- ab04fc3cbe5aa5f61e603328969673d027d82a27a5958f669893bb8f3cf66cba
- 793813ddcc1ea542c98b0c082a025a2a
- 0e94ec2e86ad128c1a998e462c3aba2b38fb0714980aa97e4013cb314127d25a
- 162e4777b60919f8d2747588181135f5664eee20
- 7d24b4af7a5b9e599862bf1566c64e6465871cf3d360676346088eb2f176ae07
- bbdd594b564452ed2c5a88a0a587f1a0
- 9a8e23b068860e3a643fffdf2164f98b75b63439466cb68feaf61a554df75fe8
- 932cdd30d33a9c30a7cad1f9f109113daf9814c9
- 408258ce7d4136a77b3e871708d56cf0
- d888ec89be375ac3547cc265de51929ca87c78894241110810ea99b91863488f
- cd00de71ec391b8a66a1a73fc85c1beb2f69cb06
- 7440e0323df806c324ebcc97306687db
- d8f6dad64c78b9767d8c2004c05bce64d30d8d268276dfff4adab45781e6fe1c
- b5b6ca51a18389e8d0fb624bd0d876041b5cdfa9
- faa90497b67d61e5462e5a76c73f8eda
- 06dc0dc2633650beab0dcf965322f86c7b25bc0509b812ce1cad7af30b653237
- 3c9b0cdf32d4fcd28fffd844e0a0a95f8ab1cba6
- b47b56767c679faea7c9217d2b95f91a
- 486626fb3b020f3b29adb002a38ae012d200f27d
- 6a09fbe1e2adf9ebd54ebfd30a5cd9e480442958b32a60cc13d615858ba05b11
- ed5471d42bef6b32253e9c1aba49b01b8282fd096ad0957abcf1a1e27e8f7551
- 2db8cce5bb24a768a7a60c28e46b8b1e1655fc5f
- 22d892ee990b3d75e3fff497b75667dd
- ca4774896299849f60e781deb86a5260
- 42a7d5522eab6a2642d58a8b34f9960f1b853c45
- 418535ad791f7400aed8a99a9ee65b835b1f6f10b9e179cf66ff19328d2b7616
TTPs & Attack Vectors
Tools, initial access, and MITRE ATT&CK techniques for bqtlock
Other
T1486
T1486
T1490
T1490
T1021
T1021
T1562
T1562
T1080
T1080
T1078
T1078
T1547
T1547
T1059
T1059
T1021.001
T1021.001
T1105
T1105
T1071.001
T1071.001
Victims(9)
| Company | Country | Status | Discovered | |
|---|---|---|---|---|
| Metro Hospital USA | United States | Negotiating | 4 months ago | |
| DGM | Israel | Claimed | 7 months ago | |
| Morning Desert Safari | United Arab Emirates | Claimed | 8 months ago | |
| Arabian Desert Safari | United Arab Emirates | Claimed | 8 months ago | |
| Dhow Cruise Dubai Harbour | United Arab Emirates | Claimed | 8 months ago | |
| Hatta Heritage Village | United Arab Emirates | Claimed | 8 months ago | |
| Adore UAE | United Arab Emirates | Claimed | 10 months ago | |
| EPS FUJ Private School UAE | United Arab Emirates | Claimed | 10 months ago | |
| European Business Server Cluster | Ireland | Claimed | 12 months ago |
Affected countries(16)
Countries where this group has been reported to target or leak victims.