Security Resilience

Threat actor · all actors

eCh0raixMISP-f3ded787 criminal

aka eCh0raix

Last updated: 2026-10-16

3attributed CVEs
0ATT&CK techniques
6.6IDF score (tooling uniqueness)
0exclusive CVEs
2021–2023years active

About this actor

Anomali researchers have observed a new ransomware family, dubbed eCh0raix, targeting QNAP Network Attached Storage (NAS) devices. QNAP devices are created by the Taiwanese company QNAP Systems, Inc., and contain device storage and media player functionality, amongst others. The devices appear to be compromised by brute forcing weak credentials and exploiting known vulnerabilities in targeted attacks. The malicious payload encrypts the targeted file extensions on the NAS using AES encryption and appends .encrypt extension to the encrypted files. The ransom note created by the ransomware has the form shown below. eCh0raix was first seen in June 2019, after victims began reporting ransomware attacks in a forum topic on BleepingComputer. On June 1st, 2020, there has been a sudden surge of eCh0raix victims seeking help in our forums and submissions to the ransomware identification site ID-Ransomware.

How we know this

Data origin
MISP threat-actor galaxy Imported from the open-source MISP threat-actor galaxy.
Techniques
No ATT&CK techniques mapped.
Named victims
None on file.

Thin data: No ATT&CK techniques are mapped yet — the behavioural profile is empty.

See how actor data is built for the full pipeline.

Activity timeline

2021: 2 CVE published2021: 1 KEV added320212022: 1 KEV added120222023: 1 CVE published2023: 1 KEV added22023
CVE publishedKEV added

Profile

CVERiskCVSSEPSSPublishedProducts
CVE-2021-44228 KEV10.010.01.00002021-12-10see CVE
CVE-2021-20038 KEV9.99.80.99912021-12-08see CVE
CVE-2022-24990 KEV8.57.50.96752023-02-07see CVE

No techniques attributed.

Co-occurring actors

Similar actors

Overlapping CVEs

Active in same years

Same category