Ransomware group profile · #57 by claimed victims

Noescape ransomware

NoEscape was a RaaS operation active from May to December 2023 believed to be a rebrand of the defunct Avaddon ransomware, targeting professional services, manufacturing, and healthcare with triple-extortion capabilities (encryption, data theft, and optional DDoS), before abruptly shutting down in an apparent exit scam.

Active First seen Jun 2023

126Victims claimed on leak sites

0Victims in the last 30 days

0Victims in the last 90 days

27Countries hit

2Leak-site URLs tracked, 0 online

4 Dec 2023Latest claim recorded

Victimology

Who Noescape claims to have breached, from 126 leak-site posts recorded by VULONE.

Claims per month last 12 months

Top sectors

Professional Services23

Manufacturing22

Healthcare14

Education13

Retail & E-Commerce11

Technology10

Government & Defense9

Agriculture and Food Production6

Top countries

United Kingdom8

United States6

France6

Italy5

Australia4

Mexico4

Spain4

Netherlands4

Latest claimed victims 12 most recent

Victim	Sector	Country	Claimed
UF Resources ufresources.com	Professional Services	—	4 Dec 2023
Nida Corp nida.com	Education	—	4 Dec 2023
Grupo PRIDES grupoprides.com	Technology	—	1 Dec 2023
Science History Institute sciencehistory.org	Education	—	30 Nov 2023
Verdecora verdecora.es	Retail & E-Commerce	ES	30 Nov 2023
TALENTUM Temporal SAS talentum.com.co	Professional Services	CO	24 Nov 2023
Rc Moore Inc rcmoore.com	Transportation	—	21 Nov 2023
Enware Australia Pty Ltd enware.com.au	Manufacturing	AU	21 Nov 2023
PruittHealth pruitthealth.com	Healthcare	—	18 Nov 2023
Kwik Industries, Inc. kwikind.com	Retail & E-Commerce	—	17 Nov 2023
Lander County Convention & Tourism Authority landercountynv.org	Hospitality	—	14 Nov 2023
Southeastern Orthopaedic Specialists sosbonedocs.com	Healthcare	—	14 Nov 2023

All 126 Noescape victims, searchable

Full victim list with claim posts, domains, timing and exports, plus the negotiation chats and leak-site screenshots VULONE archives for this crew.

Start free Sign in

Tactics, techniques and procedures

ATT&CK technique mapping for Noescape is in progress. Victimology, infrastructure status and leak-site tracking are live above.

Indicators, detections and the full playbook

Hashes, C2 addresses, onion services, Sigma and YARA detections per technique, and the negotiation transcripts are available to signed-in analysts.

See full IOCs

Frequently asked

Is Noescape ransomware still active?

Noescape is tracked as active. The most recent leak-site claim VULONE recorded is dated 4 December 2023.

How many victims has Noescape claimed?

VULONE has recorded 126 leak-site victim claims attributed to Noescape since June 2023, across 27 countries and 13 sectors.

Which industries does Noescape target?

The sectors most often named on the Noescape leak site are Professional Services, Manufacturing, Healthcare.

Which countries are most affected by Noescape?

Most Noescape victims recorded by VULONE are located in United Kingdom, United States, France.

Where does VULONE get Noescape victim data?

Claims are collected continuously from the group's own leak sites and cross-checked with ransomware.live and RansomLook. A claim is the group's assertion, not a confirmed breach.

Other ransomware groups

Victim claims are collected from leak sites and enrichment partners (ransomware.live, RansomLook) and represent the group's own assertions, not confirmed breaches. Profile last updated 16 September 2026. Questions or corrections: [email protected].