A 2025 ransomware-as-a-service criminal group known for demanding Monero payments and wave-based attacks.
BQTLock is a ransomware-as-a-service criminal group that emerged in 2025, likely linked to pro-Palestinian hacktivist networks.This actor targets organizations using wave-based campaigns, employing AES-256/RSA-4096 encryption and demanding Monero payments with a 48-hour ransom deadline.Defenders should focus on detecting Monero ransom notes, rapid encryption tactics, and potential politically motivated initial access vectors.
BQTLock is a ransomware-as-a-service operation that emerged in 2025, using AES-256/RSA-4096 encryption with Monero payment demands, linked to pro-Palestinian hacktivist networks and targeting organizations with wave-based campaigns with 48-hour ransom deadlines.
BQTLock demands ransom payments exclusively in Monero.
BQTLock uses AES-256 and RSA-4096 encryption methods.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.