Loading threat actor…
BQTLock, also known as Baqiyat 313 Locker, is a ransomware-as-a-service operation publicly disclosed in 2025 and associated with pro-Palestinian and pro-Iran-aligned hacktivist activity. The operation blends ideological and political messaging with financially coercive ransomware tradecraft, and has been linked to the broader Cyber Islamic Resistance ecosystem. Reporting has associated BQTLock with Liwaa Mohammad and Karim Fayad, also known as ZeroDayX or ZeroDayX1, and described it as a distinct platform from Sicarii despite overlap in aligned operators and affiliate redirection. BQTLock has been used in double-extortion operations, combining file encryption with threats to publish stolen data on a leak site. Victim disclosures and claimed activity indicate targeting in the United Arab Emirates, the United States, and Israel, with leak-site postings involving organizations in sectors including education and hospitality. Related channels and collaborators have also expressed interest in critical infrastructure and military targets. The operation has been promoted through Telegram-based recruitment and has offered free RaaS access to ideologically aligned hacktivists, particularly those willing to target Israeli interests. BQTLock has been presented as a preferred ransomware platform for politically motivated operators after Sicarii administrators indicated they could not support increased affiliate demand. Observed tradecraft includes initial access via exploitation of React2Shell, tracked as CVE-2025-55182, to deploy the ransomware. Associated actors have publicly claimed successful exploitation of that vulnerability against an Israeli victim. Overall, BQTLock represents a hybrid threat combining hacktivist branding, pro-Iranian and pro-Palestinian alignment, affiliate-driven ransomware deployment, data theft, and extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pro-Palestinian ideologically framed RaaS emphasizing political messaging; conducts double-extortion ransomware operations and runs a data leak site publishing victim data, with targeting noted in UAE, US, and Israel since July 2025.
Named as a new ransomware variant/gang emerging in 2024 and associated with victim claims posted in July 2024.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.