BQTLock Scheduled Task and Local Account Persistence with C2 Correlation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•7

Detects signs of persistence via suspicious scheduled task creation or local user creation/group escalation, and C2 activity involving a specific IP address or unauthorized connections to the Telegram bot API.