eCh0raix
- First seen
- 2019-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-18 06:25:53
- Profile updated
- 2026-07-07 13:43:48
Context
Anomali researchers have observed a new ransomware family, dubbed eCh0raix, targeting QNAP Network Attached Storage (NAS) devices. QNAP devices are created by the Taiwanese company QNAP Systems, Inc., and contain device storage and media player functionality, amongst others. The devices appear to be compromised by brute forcing weak credentials and exploiting known vulnerabilities in targeted attacks. The malicious payload encrypts the targeted file extensions on the NAS using AES encryption and appends .encrypt extension to the encrypted files. The ransom note created by the ransomware has the form shown below. eCh0raix was first seen in June 2019, after victims began reporting ransomware attacks in a forum topic on BleepingComputer. On June 1st, 2020, there has been a sudden surge of eCh0raix victims seeking help in our forums and submissions to the ransomware identification site ID-Ransomware.
Reports & references
- vmware.com — Vmw Exposing Malware In Linux Based Multi Cloud Environments (report)
- bleepingcomputer.com — Ongoing Ech0Raix Ransomware Campaign Targets Qnap Nas Devices (report)
- anomali.com — The Ech0Raix Ransomware (report)
- blog.netlab.360.com — Qnap Nas Users Make Sure You Check Your System (report)
- Trend Micro — Wp Backing Your Backup Defending Nas Devices Against Evolving Threats (report)
- intezer.com — Elf Malware Analysis 101 Linux Threats No Longer An Afterthought (report)
- Palo Alto Unit 42 — Ech0Raix Ransomware Soho (report)
- bleepingcomputer.com — Qnap Warns Of Ech0Raix Ransomware Attacks Roon Server Zero Day (report)
- ibm.com — Z81Avoy7 (report)
- intezer.com — Blog Russian Cybercrime Group Fullofdeep Behind Qnapcrypt Ransomware Campaigns (report)
- intezer.com — Blog Seizing 15 Active Ransomware Campaigns Targeting Linux File Storage Servers (report)
- intezer.com — When Viruses Mutate Did Suncrypt Ransomware Evolve From Qnapcrypt (report)
- qnap.com — Qsa 20 02 (report)
- ransomlook.io — Ech0Raix (report)