Skip to content
Cyber Threat
CTI Academy Sponsor CTI Academy
Ransomware group

Moneymessage ransomware

19 victims listed on the Moneymessage leak site across 6 countries. Most recent disclosure .

Victims
19
0.1% of all tracked
Countries
6
Most: United States
Sectors
8
Most: Healthcare
First seen
Jan 2024
In this database

ThreatAI analysis

Compiled from the ransomware.live profile for Moneymessage and from this database. Figures and technique mappings are quoted from the source data, not inferred.

Who Moneymessage is

Money Message emerged in March 2023 targeting Windows and Linux systems across banking, transportation, and professional services sectors, demanding ransoms in the millions and publishing stolen data on their blog if unpaid, with most known victims based in the US.

Recorded activity

Disclosures attributed to Moneymessage in this database run from January 2024 to September 2026, totalling 19 victims — 0.1% of everything tracked here. Moneymessage has listed victims in 6 countries in this database, most often United States, followed by United Kingdom and Australia. The sectors appearing most in its listings are Healthcare, Public Sector, Energy & Utilities.

YARA detection rules

moneymessage.yar 
/*
Money Message ransomware
*/

rule MoneyMessage_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.moneymessage"
        description = "Detects Money Message ransomware note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "money_message.log" ascii nocase
        $s2 = "money message" ascii nocase
        $s3 = ".money_message" ascii
        $s4 = "MoneyMessage" ascii nocase

    condition:
        any of them
}

Community-contributed rules for Moneymessage, reproduced as published. Test them against your own corpus before relying on them: rule quality and false-positive behaviour vary by author.

Threat actor analysis

Moneymessage has disclosed 19 victims on its leak site, 0.1% of all ransomware listings tracked in this database. Its earliest disclosure here dates to January 2024.

The group has listed organisations in 6 countries, most often in United States (11 victims), followed by United Kingdom, Australia, Argentina.

By industry, its listings concentrate in Healthcare, Public Sector, Energy & Utilities — sectors that hold sensitive data or cannot tolerate long outages, both of which raise the pressure to pay.

Like most current ransomware operations, Moneymessage is likely to use double extortion: data is stolen before files are encrypted, and organisations that refuse to pay are named on the leak site with the stolen data as leverage.

Generated from public leak-site disclosures aggregated via the ransomware.live API and updated automatically.

Moneymessage victims 19

Organization Disclosed
U.S. Electrical Services and Wiedenbach Brown
U.S. Electrical Services and Wiedenbach Brown
ProCare
USUnited States
Yourway Transportation
USUnited States
Indigo Energy
USUnited States
Envision Unlimited
X-Copper Professional
USUnited States
Forestdale
GBUnited Kingdom
Family Partnerships of Central Florida
USUnited States
Bucks County Opportunity Council, INC.
USUnited States
Young Adjustment Company
USUnited States
The Tech Interactive
USUnited States
Marina Family Medical
AUAustralia
National Atomic Energy Commission
ARArgentina
Kazyon
RURussia
The Egyptian Tax Authority (ETA)
EGEgypt
First Baptist Medical Center
USUnited States
Insurance Agency Marketing Services
USUnited States
Anna Jaques Hospital
USUnited States

Frequently asked questions

What is Moneymessage ransomware?

Moneymessage is a ransomware threat group that has claimed 19 victims since its first known activity in January 2024. The group operates by infiltrating target networks, exfiltrating data, encrypting files, and threatening to publish stolen data on a dark web leak site if the ransom is not paid.

How many victims has Moneymessage attacked?

Moneymessage has claimed 19 victims in our database, representing 0.1% of all tracked ransomware attacks. The most targeted countries are United States, United Kingdom, Australia, Argentina.

Which countries does Moneymessage target?

Moneymessage has attacked organizations in 6 countries. The top targeted countries are: United States, United Kingdom, Australia, Argentina.

Which industries does Moneymessage target?

Moneymessage most frequently targets the Healthcare, Public Sector, Energy & Utilities sectors based on victim disclosures in our database.

Is Moneymessage still active?

Moneymessage's most recent victim disclosure in our database was on September 21, 2026. Ransomware groups frequently rebrand or go dormant; monitor this page and our ransomware map for the latest activity.