Skip to main content
Darkfield

Operator dossier

NoEscape is a ransomware operator no longer publishing new disclosures. Darkfield has indexed 249 public victims claimed by this operator between June 12, 2023 and December 4, 2023. NoEscape is a financially motivated ransomware group that emerged in mid-2023, rapidly establishing itself as a significant threat with 249 documented victims across multiple sectors. The group's origins and affiliations remain largely undocumented by major security agencies, though their operational patterns suggest they likely operate independently rather than as a Ransomware-as-a-Service model. NoEscape demonstrates sophisticated attack methodologies targeting critical infrastructure and essential services, with their campaigns showing a clear preference for high-value targets in government, healthcare, education, finance, and manufacturing sectors across developed nations, particularly focusing on the United States, United Kingdom, Italy, France, and Australia. The group's rapid victim accumulation rate since their June 2023 emergence indicates an aggressive operational tempo and effective attack capabilities, though specific technical details about their initial access vectors, encryption methods, and extortion tactics have not been extensively documented in public threat intelligence reports from major security agencies. As of current intelligence assessments, NoEscape appears to remain an active threat with no documented law enforcement disruptions or confirmed rebranding activities.

Most-targeted sectors

Most-affected countries

Recent disclosures by NoEscape

Most recent 150 of 249 indexed disclosures. Click any row for the full per-victim dossier.

See every disclosure indexed for NoEscape →

How we know this. Operator profiles on Darkfield are built from continuous monitoring of every leak site the group is known to operate, cross-correlated with community-curated feeds (RansomLook, ransomware.live, RansomWatch, MISP-galaxy). Status flips from active to inactive when no new disclosure appears for 60 days. MITRE ATT&CK mappings shown in the interactive section below are sourced from CISA, vendor analysis, and the MITRE community catalog — we attribute each technique back to its source. Aliases reflect operator re-brands and affiliate splits.

Inactive ransomware operator

← All groups

NoEscape

249 victims indexed · first seen 3 years ago · last activity 3 years ago

249
Victims indexed
#35 of 364 tracked operators
6m
Active period
Jun 2023 → Dec 2023
10
Countries hit
top United States · 20

At a glance

Status
inactive
First seen
3 years ago
Last activity
3 years ago
Onion sites
2 known endpoints
Primary sector
Government · 3 hits

About

NoEscape is a financially motivated ransomware group that emerged in mid-2023, rapidly establishing itself as a significant threat with 249 documented victims across multiple sectors. The group's origins and affiliations remain largely undocumented by major security agencies, though their operational patterns suggest they likely operate independently rather than as a Ransomware-as-a-Service model. NoEscape demonstrates sophisticated attack methodologies targeting critical infrastructure and essential services, with their campaigns showing a clear preference for high-value targets in government, healthcare, education, finance, and manufacturing sectors across developed nations, particularly focusing on the United States, United Kingdom, Italy, France, and Australia. The group's rapid victim accumulation rate since their June 2023 emergence indicates an aggressive operational tempo and effective attack capabilities, though specific technical details about their initial access vectors, encryption methods, and extortion tactics have not been extensively documented in public threat intelligence reports from major security agencies. As of current intelligence assessments, NoEscape appears to remain an active threat with no documented law enforcement disruptions or confirmed rebranding activities.

References

1 link

External sources curated by the MISP threat-intel community.

Timeline

7 months
2023-06-01T00:00:00+00:00 · 102023-07-01T00:00:00+00:00 · 292023-08-01T00:00:00+00:00 · 422023-09-01T00:00:00+00:00 · 432023-10-01T00:00:00+00:00 · 712023-11-01T00:00:00+00:00 · 482023-12-01T00:00:00+00:00 · 6
2023-06-01T00:00:00+00:002023-12-01T00:00:00+00:00

Top countries

🇺🇸 United States
20
🇬🇧 United Kingdom
14
🇮🇹 Italy
7
🇫🇷 France
6
🇳🇱 Netherlands
4
🇲🇽 Mexico
4
🇦🇺 Australia
4
🇨🇭 Switzerland
3
United States dossier →United Kingdom dossier →Italy dossier →France dossier →

Top sectors

Government
3
Healthcare
3
Education
3
Finance
3
Manufacturing
2
Energy
2
Retail
1
Media
1
Government dossier →Healthcare dossier →Education dossier →Finance dossier →

MITRE ATT&CK

12 techniques · 10 tactics

Tactics

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionDiscoveryLateral MovementCollectionExfiltrationImpact

Techniques

  • T1566Phishing
  • T1190Exploit Public-Facing Application
  • T1059Command and Scripting Interpreter
  • T1053Scheduled Task/Job
  • T1055Process Injection
  • T1562Impair Defenses
  • T1083File and Directory Discovery
  • T1018Remote System Discovery
  • T1021Remote Services
  • T1005Data from Local System
  • T1041Exfiltration Over C2 Channel
  • T1486Data Encrypted for Impact

Recent victims

Loading…

Onion infrastructure

2 known
  • http://noescapemsqxvizdxyl7f7rmg5cdjwp33pg2wpmiaaibilb4btwzttad.onion
  • http://noescaperjh3gg6oy7rck57fiefyuzmj7kmvojxgvlmwd5pdzizrb7ad.onion

Source

Updated 3 years ago

Data on this page is sourced from the group's own leak posts, cross-checked with public ransomware trackers (RansomLook, ransomware.live, RansomWatch), MITRE ATT&CK, and our own Tor and Telegram crawlers. This is a public observatory page — share freely.

Get alerted the next time NoEscape posts a victim.

Add NoEscape to your watchlist — Pro pings you within 5 minutes of any new NoEscape leak-site post, Telegram callout, or affiliate-rebrand inference.