BQTLock Ransomware Mass File Encryption and Ransom Note Detection

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects BQTLock ransomware activity by monitoring for mass file encryption events (file extensions .bqtlock or .baqiyatlock) and the creation of associated ransom note files (README.bqtlock or HOW_TO_DECRYPT.txt) using Sysmon and Windows Security Event logs.