eCh0raix, also known as QNAPCrypt, is a Linux ransomware family that targets network-attached storage appliances, primarily QNAP devices and later Synology systems. It has been active since at least 2019, with reporting also linking it to earlier activity, and is notable for focusing on internet-exposed NAS environments used by home users, SOHO operators, and small businesses where centralized security administration is often limited.
The malware is a Go-based encryptor that traverses NAS storage, selectively skips files and directories needed to preserve device operability, and encrypts victim data using AES in cipher feedback mode before appending a new extension to affected files. It drops a ransom note and relies on Tor-hidden infrastructure, typically through SOCKS5 proxying, to obtain operational data such as encryption material, ransom text, and payment information. Older variants generated encryption keys locally and encrypted them with an RSA public key, while later variants retrieved AES keys directly from command-and-control infrastructure. Some variants include logic tailored for Synology path structures, reflecting the family’s expansion beyond QNAP-only targeting.
Observed intrusion vectors include brute-forcing weak credentials on exposed NAS devices and exploitation of known vulnerabilities in QNAP software and applications. High-confidence reporting links delivery in some campaigns to exploitation of CVE-2021-28799 in QNAP Hybrid Backup Sync 3, and other campaigns have been associated with vulnerable QTS and Photo Station components. Operators have also been described as scanning for unpatched QNAP devices. QNAP has specifically warned that weak administrator passwords increase exposure to eCh0raix attacks.
The ransomware has been associated with targeted attacks against NAS appliances rather than indiscriminate mass endpoint campaigns. Victimology centers on internet-facing storage devices that often contain backups and business-critical files, making them attractive extortion targets. Successful extortion events have been reported, and the family has remained a recurring threat in the broader wave of ransomware activity against NAS ecosystems alongside operations such as Qlocker, DeadBolt, and AgeLocker.
Technical analysis has identified implementation weaknesses in some samples, including non-cryptographic randomization for key generation in earlier variants and locale checks that avoid encrypting systems associated with Belarus, Ukraine, or Russia. These traits suggest iterative development and operational adaptation over time, but do not change its core role as a NAS-focused ransomware family built to encrypt stored data and coerce payment from device owners.
