Baqiyat 313 Locker

Reported Context (2)

BQTLock is a .NET-based ransomware that targets Windows, uses hybrid AES-256 and RSA-4096 encryption, and marks encrypted files with the .BQTLOCK extension while operating under a RansomwareâasâaâService model. Using Wazuh to Detect and Respond to BQTLock Ransomware
In March 2026, Halcyon also revealed that the administrator of Sicarii ransomware, Uke, urged pro-Iranian operators to use Baqiyat 313 Locker (aka BQTlock) due to the influx of affiliate requests. Suspected Iran-Linked Campaign Targets 300+ Israeli Microsoft 365 Organizations

Malware (1)

People (1)

Threat Actors (7)

MITRE ATT&CK (11)

Vendors (5)

Products (5)

Tools (1)

Industries (6)

Countries (6)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.