Ransomware group

BaqiyatLock Ransomware

BaqiyatLock (a.k.a. BQTLock) is a ransomware family and RaaS program publicly launched in July 2025 and explicitly presented as the “cyber weapon” of the hacktivist group Liwaa Muhammad. An official statement published under the banner “Liwa’ Muhammad ﷺ” announces “our cyber tool: BaqiyatLock (BQTLock Ransomware)” and describes it as an advanced digital weapon to encrypt enemy systems, with variants for web servers, Linux, Windows and macOS.

Created by iQBlack CTI Team
Contributors 2
Last updated 2026-08-19

Aliases

Aliases

BQTLock

ATT&CK

MITRE ATT&CK

T1041Exfiltration Over C2 Channel
T1053.005Scheduled Task
T1055.012Process Hollowing
T1083File and Directory Discovery
T1136.001Local Account
T1486Data Encrypted for Impact
T1490Inhibit System Recovery
T1497.001System Checks
T1548.002Bypass User Account Control
T1562.001Disable or Modify Tools
T1566.001Spearphishing Attachment
T1583.006Web Services
T1587.001Malware