noescape

Executive Summary

The NoEscape ransomware operation, believed to be a rebrand of Avaddon, targeted professional services, manufacturing, and healthcare sectors with triple-extortion capabilities from May to December 2023. The group abruptly shut down in an apparent exit scam, but not before compromising 126 organizations. NoEscape's activities highlight the ongoing threat of ransomware operations and the need for vigilance among potential targets.

Goals & Targeting

NoEscape's strategic objectives were centered on achieving financial gain through ransom payments, with a focus on targeting sectors that are likely to have valuable data and a willingness to pay to avoid the consequences of a breach. The group's typical victims were organizations within the professional services, manufacturing, and healthcare sectors, where data confidentiality and availability are critical. By targeting these sectors, NoEscape aimed to maximize its potential returns while minimizing the risks associated with targeting more resilient or well-protected organizations.

NoEscape was a medium-sophistication ransomware-as-a-service (RaaS) operation that emerged in May 2023 and was active until December 2023. The group is believed to be a rebrand of the defunct Avaddon ransomware operation, suggesting a level of continuity and potential connections to previous ransomware campaigns. NoEscape's primary motivation was organizational gain, specifically financial gain through ransom payments, and the group employed a triple-extortion model to maximize pressure on its victims.

Key Capabilities

• Ransomware development and deployment
• Data exfiltration and extortion
• DDoS capabilities
• Negotiation and ransom payment handling
• Victim profiling and targeting

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

NoEscape's campaign patterns were characterized by a high volume of attacks against a broad range of targets, with a focus on maximizing financial returns through efficient and effective extortion tactics. The group's operational tempo was marked by a steady stream of attacks throughout its active period, with some variability in terms of targeting and tactics. Notable past operations include the compromise of 126 organizations, with many of these incidents involving triple-extortion tactics and significant ransom demands.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 over HTTP/HTTPS using compromised websites
• Staging infrastructure on virtual private servers (VPS)
• Data exfiltration via FTP/FTPS

Recommended Actions

• Implement robust email security controls to prevent spear-phishing attacks
• Use endpoint detection and response (EDR) tools to detect and block ransomware
• Conduct regular backups and ensure data availability
• Implement a incident response plan for ransomware attacks
• Provide training to employees on recognizing and reporting suspicious activity

Suggested Tags