‘NoEscape’ Ransomware-as-a-Service (RaaS)

**Executive Summary:** Cyble Research & Intelligence Labs observed a newly advertised Ransomware-as-a-Service (RaaS) named 'NoEscape' (May 2023) that claims C++ development, multi-platform support (Windows XP–11, Server 2003–2022, Linux distributions, VMware ESXi), ChaCha20 + RSA-2048 hybrid encryption, Safe Mode boot evasion, asynchronous LAN/SMB scanning for lateral movement, shared-key encryption options, Tor-hosted admin/leak infrastructure, affiliate recruitment and triple-extortion capabilities; the report details TTPs and business model but highlights limited evidence tying prior samples to this advertised program.