Threat Actor Characterization
BAQIYAT BOTNET
ID: 0e765fc626d781204c85098a345f61cc33492| BQTnet 313 | BQTnet313 | — | — |
Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
52181236828dad7e9dfee83ce6f06fb974656 | BaqiyatLock Ransomware | Iran | ally-of | Crimeware |
|
e7989a1b480a1ac465a3e99715c18df365519 | BQT OSINT | Iran | ally-of | Crimeware |
|
daa2f2eca3d71232dcb50eca4d550f7182653 | BQTScanner | Iran | affiliated | Crimeware |
|
8f27533a6eae91685fa0355542c0b3db | Cyber Islamic Resistance | Lebanon | related | Hacktivist Group |
|
7e4300d61387b4122e9dbde567aedccb43759 | Liwaa Muhammad | Lebanon | ally-of | Cybercrime |
|
b22082f01937a09ecda662b7f056772074331 | ZeroDayX1 | Lebanon | founder | Cybercrime |
Related files
Actor Network Graph
Open Network GraphMITRE ATT&CK®
BAQIYAT BOTNET is best assessed as a functional crimeware and infrastructure ecosystem tied to Baqiyat 313 Locker / BQTLock rather than a fully separate actor brand. Public reporting points to companion Telegram channels for scanning, OSINT and RaaS operations, suggesting a modular support stack used for victim acquisition, operational coordination and ransomware enablement.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1583.001 | Domains | TA0042 |
|
| T1595 | Active Scanning | TA0043 |
|
| T1587.001 | Malware | TA0042 |
|
| T1486 | Data Encrypted for Impact | TA0040 |
|
BAQIYAT BOTNET
Classification: Unclassified / Open Source Intelligence (OSINT) — TLP:WHITE
Category: Crimeware / Botnet-scanner ecosystem - Origin: Likely Middle East-linked operator set
Author: iQBlack CTI Team
Executive Summary
BAQIYAT BOTNET is best assessed as a functional crimeware and infrastructure ecosystem tied to Baqiyat 313 Locker / BQTLock rather than a fully separate actor brand. Public reporting points to companion Telegram channels for scanning, OSINT and RaaS operations, suggesting a modular support stack used for victim acquisition, operational coordination and ransomware enablement.
Public reporting indicates that this actor or brand matters less because of bespoke technical sophistication than because of its position inside a wider mobilization, propaganda, ransomware, or coalition ecosystem.
