BQTLock Ransomware: C2 Download, Payload Chain, SSH Abuse & Mass Encryption

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•5

This rule detects multi-stage behavior associated with the BQTLock ransomware, including C2 network communication, execution of loaders (PyInstaller-based) from common writable directories, suspicious child process spawning, unauthorized OpenSSH service usage potentially indicating privilege escalation, and mass file encryption indicated by both specific file extensions and bulk rename heuristics.