Back Reddit

Emerging Ransomware: BQTLock and GREENBLOOD

Reddit •/u/malwaredetector • February 11, 2026

Full article: TL;DR BQTLock is a stealthy ransomware-linked chain. It injects Remcos into explorer.exe, performs UAC bypass via fodhelper.exe, and sets autorun persistence to keep elevated access after reboot, then shifts into credential theft / screen capture, turning the incident into both ransomware + data breach risk. GREENBLOOD is a Go-based ransomware built for rapid impact: ChaCha8-based encryption can disrupt operations in minutes, followed by self-deletion / cleanup attempts to reduce forensic visibility, plus TOR leak-site pressure to add extortion leverage beyond recovery. In both cases, the critical window is pre-encryption / early execution : stealth setup (BQTLock) and fast encryption (GREENBLOOD) compress response time and raise cost fast. submitted by /u/malwaredetector [link] [ ]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

BQTLock and GREENBLOOD Ransomware Cause Significant Business Disruption BQTLock and GREENBLOOD are newly identified ransomware threats that have emerged, targeting businesses for rapid disruption. BQTLock employs stealth techniques, including credential theft and screen capture, while GREENBLOOD utilizes Go-based encryption for swift operational impact. Both ransomware types pose risks of data breaches alongside their primary ransomware functions. 4 sources 47

Extracted Entities

Emerging Ransomware: BQTLock and GREENBLOOD

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (7)

Ransomware Groups (2)

Tools (1)