Return-Path: Delivered-To: alvarochf@traceseis.com Received: from cs510.bluehost.com by cs510.bluehost.com with LMTP id KLKiIwd7jWla9wAAWiBQxw (envelope-from ) for ; Thu, 12 Feb 2026 00:02:31 -0700 Return-path: Envelope-to: alvarochf@traceseis.com Delivery-date: Thu, 12 Feb 2026 00:02:31 -0700 Received: from mail024.mlsend.com ([185.225.161.24]:60329) by cs510.bluehost.com with esmtps (TLS1.3) tls TLS_AES_128_GCM_SHA256 (Exim 4.98.2) (envelope-from ) id 1vqQid-00000000IYD-0bNJ for alvarochf@traceseis.com; Thu, 12 Feb 2026 00:02:31 -0700 DKIM-Signature: a=rsa-sha256; bh=nU4xbDs5sCIkK92NNGhfxGzqHjNyS51IUisL7U+BTb8=; c=relaxed/relaxed; d=mail.any.run; h=DKIM-Signature:X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1770879738; v=1; b=klqOnG5lRvD0/4XBHKP4WveUOcXwNg6jx9O+W0j5n+r2m+93ppKZmRbe9Ow6ayc24HNONafk MdUGf59Mvr6gp01qG2/2YpNrRcUj21cNIFMmKj1vWc8ByEVZsKxlRXGgShl4l4Ol6hCvdYqBpSS KNhkkbxTPUVNWXETIdp80UA4= DKIM-Signature: a=rsa-sha256; bh=nU4xbDs5sCIkK92NNGhfxGzqHjNyS51IUisL7U+BTb8=; c=relaxed/relaxed; d=mlsend.com; h=X-Mailer-Info:Subject:From:To:Date:Received:Message-ID:x-mailer-recipientid:Feedback-ID:List-Unsubscribe-Post:List-Unsubscribe:Precedence:X-Mailru-Msgtype:X-CampaignID:Reply-To:MIME-Version:Content-Type; s=litesrv; t=1770879738; v=1; b=I4bxjcqTFtP248Zjy+gLZFmTeMUItfGFcmsUv2/yKF7Jj7cSLW+noYoxFerkvBozL/EVO8H+ M6C5uLZWSVRRnetSGEc05I8iaD3sdjRTCFlfNHL2aEFKQ/qzRw0ENV4vaUWfg7HBGewZhn+Jj0A PpKILwdoV7xc9runlmBdU1OI= X-Mailer-Info: 10.MWYtBXYpdmb.MWYtBXYpdmbxcTOxAzM3gjN4ADN5cDM1QTM.EGb2FmcvNGa mBEdyF2YlNXZpNnLj9Wb.QM3kTMxQTM1ETN2kzN4YzNxETY0EzN3YDN.... Subject: Alvaro, New Ransomware Delays Detection From: "The ANY.RUN Analyst Team" To: Alvaro Date: 12 Feb 2026 07:02:18 -0000 Received: from 10.36.15.38 by 10.164.0.44 with http; 12 Feb 2026 07:02:18 +0000 Message-ID: <179114151569786711a417764@mlsend.com> x-mailer-recipientid: 179114151569786711a417764 Feedback-ID: campaign179103786791339043:417764:campaign:MailerLite List-Unsubscribe-Post: List-Unsubscribe=One-Click List-Unsubscribe: Precedence: bulk X-Mailru-Msgtype: 179114151569786711 X-CampaignID: 179103786804970541 Reply-To: "The ANY.RUN Analyst Team" MIME-Version: 1.0 Content-Type: multipart/alternative; boundary="==52c4c8481fd0149eabfd0c9a4e4452f5" This is a multi-part message in MIME format. --==52c4c8481fd0149eabfd0c9a4e4452f5 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: quoted-printable Hello, You have received a newsletter from ANY. RUN. However, your email software can't display HTML emails. You can view the= newsletter by clicking here: https://letter.mail.any.run/emails/webview/417764/179114151569786711 You're receiving this newsletter because you have shown interest in ANY.= RUN. Not interested anymore? Click here to unsubscribe: https://letter.mail.any.run/unsubscribe/417764/179114151569786711?signat= ure=3D190ffcc1a7ebef0489ceafdce27f87cc6e3c9556f865eaa18975f511d3ea8376 --==52c4c8481fd0149eabfd0c9a4e4452f5 Content-Type: text/html; charset=UTF-8 Content-Transfer-Encoding: quoted-printable =20 =20 Alvaro, New Ransomware Delays Detection =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20 =20 =20
 Get detailed analysis and an actio= nable plan to detect it before downtime
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20
=20 =20 =20
=20 =20
3D"ANY.RUN"
=20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20 =20

Wh= at we=E2=80=99re seeing in active ransomware campaigns
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20
=20 =20
=20 =20
=20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20 =20

Hi Alvaro!

We=E2=80=99v= e investigated two new active ransomware: BQTLock and GREENBLOOD, d= ocumenting how they escalate inside real environments and how ANY.RUN he= lped to detect these attacks.

=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20
=20 =20 =20 =20 =20
=20
Read full analysis
=20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
=20 =20 =20 =20 =20
=20 =20
=20 =20 =20 =20 =20 =20
=20

BQTLock: Hiding in system ac= tivity

BQTLock d= oesn=E2=80=99t make noise right away but runs through legitimate Windows= processes. That is what makes it dangerous: everything looks norma= l, so it has time to move and access sensitive data.

Explore BQTLock execution flow =E2=86=92

     
    =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
    =20 =20 =20 =20 =20
    =20 =20
    =20 =20 =20 =20 =20
    =20

    GREENBLOOD: New geo-targeted= threat

    This new = ransomware locks data, deletes traces of itself to limit forensic visibi= lity, and threatens data leaks through a TOR site.

    For SOC t= eams, timing is the real issue here. By the time encryption is visible, = data may be already exfiltrated and response options become more limited= .

      View GREENBLOOD attack chain =E2=86=92=

         
        =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
        <= /td>
        =20 =20 =20 =20 =20
        =20 =20
        =20 =20 =20 =20 =20 =20
        =20

        Detect earlier and prove fas= ter

        Expand IO= Cs into the full context: related domains, IPs, hashes, and linked activ= ity using TI Lookup. Run samples in the Interac= tive Sandbox to see its behav= ior, step by step.

           
          =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
          =20 =20 =20 =20 =20
          =20 =20 =20 =20 =20
          =20 =20
          =20 =20
          =20 =20 =20 =20 =20
          =20 =20 =20 =20
          =20 =20 =20 =20 =20
          =20
          		=20

          Start analyzing =E2=86= =92

          =20
          =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
          <= /td>
          =20 =20 =20 =20 =20
          =20 =20
          =20 =20 =20 =20 =20 =20
          =20

          Stay safe= and keep hunting,
          The ANY.RUN Analyst Team

          =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
          =20 =20 =20 =20 =20
          =20 =20
          =20 =20 =20 =20 =20 =20
          =20
          =20
          =20 =20 =20 =20 =20
          =20 =20 =20 =20 =20
          =20 =20

          ANY.R= UN

          Dubai Silicon= Oasis, Techno Hub 1,
          Unit 21, 60th Street, 342001, UAE

          =
          =20
          3D"linkedin" 3D"x" 3D"youtube" 3D"reddit" 3D"discord"
          =20

          Privacy & Terms | Send Feedback
          For any queries: support@an= y.run

          You received this email because 
          you signed up for = our newsletter

          Unsubscribe =20 =20 =20

          =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20 =20
          <= /td>
          =20 =20 =20 =20 =20
          =20 =20 =20
          =20 =20 --==52c4c8481fd0149eabfd0c9a4e4452f5--