BQTLock Screenshot Capture and Telegram Exfiltration (BQT.exe)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

This rule detects the BQTlock ransomware behavior of capturing desktop screenshots using suspected malicious processes ('BQT.exe', 'start.exe') and attempting to exfiltrate the captured data via the Telegram API using 'sendPhoto' or 'sendDocument' commands.