BQTLock Exfiltration via Telegram Bot API and Discord Webhooks

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•4

Detects BQTLock (BaqiyatLock) ransomware activities involving the exfiltration of stolen data, credentials, or infection reports. The rule identifies suspicious outbound network connections to known C2-enabling web services (Telegram Bot API and Discord webhooks) initiated by the BQT.exe or start.exe processes, which are typical indicators of this ransomware variant.