Description Summary
The QNAPCrypt ransomware works similarly to other ransomware, including encrypting all files and delivering a ransom note. However, there are several important differences: 1. The ransom note was included solely as a text file, without any message on the screen—naturally, because it is a server and not an endpoint. 2. Every victim is provided with a different, unique Bitcoin wallet—this could help the attackers avoid being traced. 3. Once a victim is compromised, the malware requests a wallet address and a public RSA key from the command and control server (C&C) before file encryption.
Threat Actor
Operator/affiliate cluster behind the Ech0raix leak site. Detailed actor attribution is not available in curated public reporting.
Technical Indicators
Encryption Extension
Not publicly reported
Encryption Algorithm
Not publicly reported
Ransom Note Name
Not publicly reported
Targeted Industries
Cross-sector (per leak-site victim telemetry)
First Seen
Unknown
Last Seen
No public victim disclosures observed
Geographical Location
Global / not publicly profiled
MITRE ATT&CK Matrix
| Tactic | TTP | Technique Name |
|---|---|---|
| Impact x 2 | T1486 | Data Encrypted for Impact |
| T1490 | Inhibit System Recovery | |
| Exfiltration x 1 | T1567 | Exfiltration Over Web Service (leak site) |
| Initial Access x 2 | T1190 | Exploit Public-Facing Application |
| T1078 | Valid Accounts |