NoEscape Ransomware Uses Reflective DLL Injection Tactics

This report analyzes NoEscape, a newly observed Ransomware-as-a-Service actively advertised to affiliates that can produce Windows (EXE/DLL/reflective DLL) and Linux/ESXi (ELF) payloads; it documents technical behaviors (mutex, UAC bypass via EnableLUA/ConsentPromptBehaviorAdmin, process/service termination, CryptoAPI and ChaCha20 encryption, backup/shadowcopy deletion), ESXi-targeting scripts that stop VMs and encrypt VM/NFS volumes, dropped ransom notes, IOCs (file hashes and script names), ATT&CK mappings, and recommended defensive measures.