Loading threat actor…
BaqiyatLock, also referred to as BQTlock, is a ransomware-as-a-service operation associated with the pro-Iran cyber ecosystem active during the 2026 Iran-Israel conflict. The group publicly advertised free affiliate access for actors willing to target Israeli interests, indicating an effort to blend criminal ransomware activity with ideologically aligned targeting. This positioning places BaqiyatLock at the intersection of financially motivated cybercrime and politically charged proxy or hacktivist operations. Available reporting ties BaqiyatLock to opportunistic recruitment of affiliates rather than to a documented body of high-sophistication intrusions. Its known role is as a RaaS provider enabling third parties to conduct ransomware attacks, and its public messaging specifically encouraged operations against Israeli organizations. In the broader campaign environment in which it appeared, Iranian-aligned actors and personas were observed emphasizing disruptive and retaliatory activity, including distributed denial-of-service attacks, website defacements, credential attacks, hack-and-leak behavior, and opportunistic ransomware. However, high-confidence public facts for BaqiyatLock specifically support its operation as a ransomware affiliate program and its explicit solicitation of attacks on Israeli targets. BaqiyatLock is best understood as a criminal enablement brand operating within a conflict-driven influence and retaliation ecosystem. Its known alias is BQTlock.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Geographies tied to known operations.
Attributed origin per open-source reporting.
9 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Pseudo-ransomware actor blending ideological and criminal motives, offering free affiliate access for attacks on Israeli organizations and deploying destructive pseudo-ransomware.
RaaS group offering free affiliate memberships to hacktivists willing to target Israel.
Ransomware-as-a-service group that publicly offered free affiliate access for operations targeting Israeli interests, suggesting opportunistic ideologically framed ransomware activity.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.