BQTLock & GREENBLOOD Ransomware Attacking Organizations to Encrypt and Exfiltrate Data

**Executive Summary:** The report describes two emerging ransomware families—BQTLock, which prioritizes stealth and espionage by injecting a Remcos payload into explorer.exe, performing a UAC bypass via fodhelper.exe, establishing autorun persistence, and harvesting credentials/screens for extortion; and GREENBLOOD, a Go-based, fast-acting strain using ChaCha8 encryption, rapid artifact deletion, and a TOR leak site to maximize impact. Analysts observed both families in ANY.RUN sandboxes, highlighting behavioral IOCs and recommending behavioral/endpoint monitoring to detect pre-encryption indicators and prevent compromise.