BQTLock C2 via Telegram Bot API and Discord Webhook by Non-Browser Process

Ibrahim Saud@tektrix

•updated Jun 30, 2026•4•0•6

Detects network, DNS, and process-level activity associated with BQTLock ransomware command-and-control communication, specifically targeting Telegram Bot API and Discord webhook traffic originating from non-standard (non-browser/non-messaging) processes.