BQTLOCK Ransomware Attacking Windows Users Via Telegram to Encrypt Files and Delete Backup

Security researchers have uncovered a new ransomware-as-a-service (RaaS) strain named BQTLOCK that targets Windows users via Telegram channels and dark web forums. Since mid-July, affiliates have been distributing a ZIP archive containing a malicious executable that encrypts a wide range of file types, appends a custom “.bqtlock” extension, and deletes system backups to hinder recovery.

BQTLOCK uses multiple anti-analysis measures, including string obfuscation and debugger checks, and employs various techniques to evade analysis and VM detection. On execution, Update.exe encrypts files under 50 MB with AES-256 and protects the AES keys with RSA-4096, then renames files with the “.bqtlock” extension and drops a ransom note.

Victims are asked to pay in Monero within 48 hours via Telegram or X, with a note stating that failure to respond will double the ransom and that decryption keys will be deleted after seven days. ZeroDayX, the alleged leader behind the group, claims BQTLOCK is fully undetectable by antivirus vendors, though the article notes limited submissions on VirusTotal and a corrupted ISO sample.