BQTLock Screen Capture and Exfiltration via Telegram sendPhoto API

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects BQTLock ransomware (BQT.exe) identifying and exfiltrating captured desktop screenshots via the Telegram Bot API 'sendPhoto' endpoint. The rule monitors network connections initiated by the identified malware process to api.telegram.org.