BQTLock Reconnaissance via BQT.exe Spawning Discovery Commands

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

Detects the BQTLock (BaqiyatLock) ransomware executing various system and network discovery commands such as systeminfo, ipconfig, and whoami from its main process (BQT.exe). These actions are indicative of pre-encryption reconnaissance used to profile the host environment before malicious file encryption commences.