BQTLock IP Recon + C2/Telegram Exfiltration Correlated Activity

Ibrahim Saud@tektrix

•updated Jun 30, 2026•12•0•7

Detects coordinated malicious behaviors associated with BQTLock ransomware, specifically identifying external IP reconnaissance, direct communication with known C2 infrastructure, abuse of the Telegram API for command-and-control or exfiltration, and host enumeration via system utilities by non-standard processes. The rule aggregates these suspicious signals and triggers an alert when multiple events occur within the same process storyline.