NoEscape

NoEscape is a malicious software, or malware, known for its ransomware capabilities. It infiltrates systems often undetected via suspicious downloads, emails, or websites, causing significant harm by stealing personal data, disrupting operations, and holding data hostage for ransom. In October 2023, NoEscape orchestrated a major data breach against the French basketball team ASVEL. In the last quarter of 2023, the Talos Incident Response team reported their first encounters with NoEscape, along with Play, Cactus, and BlackSuit ransomware, noting a 17% rise in ransomware incidents during this period. The malware has been linked to other ransomware strains like Rhombus, as revealed by static analysis of the Hadooken binary and Aqua's malware study. However, dynamic analyses showed no active use of these links during attacks. The Cybersecurity and Infrastructure Security Agency (CISA) and the Federal Bureau of Investigation (FBI) have identified an Iranian group, Fox Kitten, as providing initial access to compromised networks to operators of ransomware strains such as ALPHV (or BlackCat), Ransomhouse, and NoEscape, in return for a cut of any ransom collected. In December 2023, following the FBI’s announcement of a disruption campaign against the ALPHV ransomware, the LockBit ransomware group made a public call on a Russian-speaking dark web forum to recruit ALPHV (BlackCat) and NoEscape ransomware affiliates, including any ALPHV developers. This move indicates a potential shift in the landscape of cyber threats, with established groups seeking to consolidate power and resources in the face of increased law enforcement actions.