QNAPCrypt
Aliases: eCh0raix
- First seen
- 2019-06-01 00:00:00
- Malware type
- ransomware
- Family
- Malware family
- Last IoC activity
- 2026-07-18 06:25:53
- Profile updated
- 2026-07-07 13:43:52
Targeted industries: technology-and-telecommunications
Context
QNAPCrypt, also known as eCh0raix, is a ransomware strain targeting network-attached storage (NAS) devices, particularly those from QNAP. It encrypts files on compromised devices, demanding a ransom in cryptocurrency for decryption.
Detection coverage
- 4 YARA rules
Detection rules
- ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_1 (yara-rule)
- ARKBIRD_SOLG_RAN_ELF_Qnapcrypt_Aug_2021_2 (yara-rule)
- DITEKSHEN_MALWARE_Win_Qnapcrypt (yara-rule)
- DITEKSHEN_INDICATOR_KB_Gobuildid_Qnapcrypt (yara-rule)
Reports & references
- vmware.com — Vmw Exposing Malware In Linux Based Multi Cloud Environments (report)
- anomali.com — The Ech0Raix Ransomware (report)
- blog.netlab.360.com — Qnap Nas Users Make Sure You Check Your System (report)
- Trend Micro — Wp Backing Your Backup Defending Nas Devices Against Evolving Threats (report)
- intezer.com — Elf Malware Analysis 101 Linux Threats No Longer An Afterthought (report)
- Palo Alto Unit 42 — Ech0Raix Ransomware Soho (report)
- bleepingcomputer.com — Qnap Warns Of Ech0Raix Ransomware Attacks Roon Server Zero Day (report)
- ibm.com — Z81Avoy7 (report)
- intezer.com — Blog Russian Cybercrime Group Fullofdeep Behind Qnapcrypt Ransomware Campaigns (report)
- intezer.com — Blog Seizing 15 Active Ransomware Campaigns Targeting Linux File Storage Servers (report)
- intezer.com — When Viruses Mutate Did Suncrypt Ransomware Evolve From Qnapcrypt (report)
- qnap.com — Qsa 20 02 (report)
- malpedia.caad.fkie.fraunhofer.de — Elf.Qnapcrypt (report)