“This post will delve into a recent incident response engagement… involving the Ransomware-as-a-Service known as NoEscape.”
NoEscape
NoEscape is a financially motivated ransomware family and ransomware-as-a-service operation that emerged in 2023 and is widely assessed as likely related to, or a rebrand of, Avaddon.
Profile source: Mallory opens in a new tabNoEscape
Family profile
NoEscape is a financially motivated ransomware family and ransomware-as-a-service operation that emerged in 2023 and is widely assessed as likely related to, or a rebrand of, Avaddon. It supports attacks against Windows and Linux environments and is used in multi-extortion campaigns that combine file encryption with data theft and public shaming through a Tor-based leak site. Some reporting also indicates the operation offered additional coercive options such as DDoS or spam-based pressure. Victimology observed in 2023 showed a concentration on organizations in the United States, with manufacturing, education, and construction among affected sectors, while the malware includes logic commonly associated with CIS-avoidance behavior seen in Russian-speaking ransomware ecosystems.
On Windows, NoEscape includes anti-debugging checks, language-based execution filtering, host and drive discovery, process and service termination, backup and shadow-copy deletion, event-log clearing, and stealthier command execution through COM and WMI. It can tamper with UAC-related settings, copy itself into user-space locations, and establish persistence via a scheduled task commonly named to resemble a system update. The encryptor uses embedded configuration data protected with RC4 and Base64 decoding, leverages Windows CryptoAPI in its encryption workflow, and uses public-key cryptography to protect generated encryption material. It also collects host metadata and appends encrypted victim information to the ransom note.
Intrusions associated with NoEscape affiliates have involved exploitation of internet-facing Microsoft Exchange servers via ProxyShell, webshell deployment, credential dumping from LSASS, use of valid accounts, lateral movement over RDP, tunneling for persistent access, and exfiltration to cloud storage prior to ransomware execution. Separate reporting also describes NoEscape operators acquiring previously established access from initial access brokers after long-dwelling Exchange compromises, then using credential-capture techniques, remote administration tools, network enumeration, lateral movement, and likely exfiltration before deployment. Public reporting has also linked Iranian actors to partnerships with affiliates of the NoEscape ecosystem for revenue-sharing arrangements. Overall, NoEscape is best characterized as a mature double-extortion ransomware operation with cross-platform payload generation, conventional enterprise-impacting tradecraft, and affiliate-driven intrusion activity.
Capabilities
- Credential Theft
- Ddos
- Defense Evasion
- Exfiltration
- Lateral Movement
- Persistence
- Post Exploitation
- Privilege Escalation
Operational record
1
YARA rules
3
Ransom notes
2
Negotiations
2
Leak sites
0 available
Reported operators
Threat actors
1 named in public reportingExploited software
Vulnerabilities linked to NoEscape
3 CVEsMITRE ATT&CK
NoEscape in ATT&CK
1 distinct techniquesTechniques
1 techniqueReporting
Research mentioning NoEscape
Sep 13
Bleeping Computer
New Linux malware Hadooken targets Oracle WebLogic servers
Attackers have been targeting Oracle WebLogic servers with a newly identified Linux malware dubbed Hadooken, using compromised access to install a cryptominer and the Tsunami DDoS botnet. Researchers observed the activity on a honeypot and found the initial intrusion relied on weak credentials rather than exploitation of a software flaw, after which the operators used shell and Python-based tooling to deploy malware, gain persistence through cron jobs, and erase logs to reduce visibility. Post-compromise activity showed the attackers searching for SSH data, attempting lateral movement, and expanding control across Linux environments. Analysis also linked Hadooken infrastructure and code overlaps to RHOMBUS and NoEscape ransomware families, while a PowerShell payload hosted on a related delivery server was seen downloading Mallox ransomware for Windows, indicating the campaign may combine immediate monetization through cryptomining and DDoS with follow-on ransomware operations against mixed Linux and Windows estates.
Sep 12
Aquasec Other
