money message
ransomware group · aka MoneyMessage · unknown (no confirmed country or language attribution in public reporting) · active since 2023-03
Victims · 7d
0flat
Victims · 30d
1active targets
Victims · 90d
5
All-time (tracked)
35since 2023-04-08
Last post
08-28 16:33UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Money Message is a double-extortion ransomware group first observed around March 2023, operating its own Tor leak site and demanding ransoms under threat of data publication. Vendor research in 2023 reported it targeting on-premises Microsoft Exchange environments for initial access, and its ransom notes were noted for threatening to notify regulators, stock exchanges, and business partners about victims' breaches. Researchers have described it as a self-contained operation rather than a ransomware-as-a-service affiliate brand, and 2024 vendor reporting described shared infrastructure and operations with the CryptNet ransomware operation. Dashboard tracking shows persistent but low-volume leak-site activity (5 victims in the last 90 days, 5 total since 2026-07-02), with the most recent post on 2026-08-28. The group's leadership, country of origin, and total illicit earnings are unknown in public reporting.
Tactics & tooling
- Double extortion: exfiltrates data before encryption and publishes victims on a Tor leak site if ransom is unpaid
- Ransom notes reportedly threaten to inform regulators, stock exchanges, and customers about the breach (vendor reporting, 2023)
- Reported initial access through unpatched on-premises Microsoft Exchange servers, including ProxyShell-era exploitation (vendor research, 2023)
- Operates as a self-contained crew rather than a RaaS affiliate program (vendor reporting)
- Low-volume, selective targeting with weeks-long gaps between leak-site postings (dashboard tracking)
- 2024 vendor research reported shared infrastructure and operational overlap with the CryptNet ransomware group
Targeted sectors
manufacturinghealthcaretransportationenergynonprofit/social serviceseducation/museumsinsurance
Notable public victims
Jacuzzi Group (claimed 2023; reported by BleepingComputer), The Tech Interactive (claimed on leak site; dashboard-tracked), National Atomic Energy Commission (claimed on leak site; dashboard-tracked), Young Adjustment Company (claimed on leak site; dashboard-tracked)
Estimated earnings
No public figure.
Leak-site victims35 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| ProCare | · 18d ago | — |
| Yourway Transportation | · Jul 25, 2026 | — |
| Indigo Energy | · Jul 23, 2026 | — |
| Envision Unlimited | · Jul 9, 2026 | — |
| X-Copper Professional | · Jul 2, 2026 | — |
| Forestdale | · May 12, 2026 | — |
| Family Partnerships of Central Florida | · Jan 28, 2026 | — |
| Bucks County Opportunity Council, INC. | · Aug 4, 2025 | — |
| Young Adjustment Company | · Jul 15, 2025 | — |
| The Tech Interactive | · Apr 18, 2025 | — |
| Marina Family Medical | · Jan 18, 2025 | — |
| National Atomic Energy Commission | · Dec 18, 2024 | — |
| Kazyon | · Dec 13, 2024 | — |
| The Egyptian Tax Authority (ETA) | · Nov 17, 2024 | — |
| First Baptist Medical Center | · Jun 19, 2024 | — |
| Insurance Agency Marketing Services | · May 16, 2024 | — |
| Anna Jaques Hospital | · Jan 19, 2024 | — |
| Tri-Way Manufacturing Technologies | · Oct 12, 2023 | — |
| Toscana Promozione | · Oct 3, 2023 | — |
| MD LOGISTICS | · Oct 3, 2023 | — |
| Maxco Supply | · Oct 3, 2023 | — |
| Riverside Logistics | · Sep 3, 2023 | — |
| Estes Design & Manufacturing | · Sep 3, 2023 | — |
| Aiphone | · Sep 3, 2023 | — |
| Taylor University | · Sep 2, 2023 | — |
| Propper International | · Jul 14, 2023 | — |
| Meteksan Defence Industry | · Jul 14, 2023 | — |
| Aspen Dental Management Inc. | · May 13, 2023 | Aspen Dental Management, Inc. is an American dental support organization, a dental practice management corporation that provides business support and administrative services in the US. Its headquarters is in Chicago, Illinois. Aspen Dental's revenue is $2.3 Billion https://www.aspendental.com/ |
| Biman airlines | · Apr 8, 2023 | Biman Bangladesh Airlines (Bengali) is the national flag carrier airline of Bangladesh. The airline provides international passenger and cargo services to Asia and Europe, as well as major domestic routes inside Bangladesh. Website:www.biman-airlines.com Revenue: $946.7M Bitman Airlines (Bangladesh) Encrypted network. Leaked data: Flight information includes passenger information, crew information, cargo information) Databases from network (hrms, SunSystemsData, Ctrain, erp, smarterp, BimanProd, bgdbf and others) Passport details of both passengers and employees Various reports from carrier portals |
| Hawaii self storage | · Apr 8, 2023 | Hawaii Self Storage is a locally owned company, committed to service the people & businesses in Hawaii with exceptional storage services. Data 32GB: |
| Pharmerica.com & BrightSpring Health Services | · Apr 8, 2023 | Headquartered in Louisville, Kentucky, PharMerica is one of the largest and fastest-growing institutional pharmacy companies in the United States. Our premier pharmacy services, with more than 180 long-term care pharmacies in almost every state, have a national scope but a local approach. Revenue: $3B BrightSpring Health Services is the leading provider of complementary home- and community-based health services for complex populations in need of specialized and/or chronic care. We focus on providing quality outcomes, through best-in-class service and technology capabilities. Revenue: $5.4B |
| Micro Star International | · Apr 8, 2023 | Micro-Star International AKA MSI designs, manufactures, and sells motherboards and graphics cards for customers in the United States, Canada, and internationally. MSI is headquartered in Taipei, Taiwan. MSI source code, including framework to develop bios, also we have private keys. We will publish stolen data when timer expires. Databases: wwrlt2, eais, CTMS, ERP. Revenue: $7B Website: msi.com |
| midamericanglass.com | · Apr 8, 2023 | Mid-American Glass is a regional distributor / fabricator of flat glass, insulating glass, and architectural metal. While flat glass distribution remains the strength of our company, our fabrication of insulating glass and architectural metal continues to drive our growth. Website www.midamericanglass.com Revenue $11.4M |
| Goldenbear.com & mjhallandcompany.com | · Apr 8, 2023 | GOLDENBEAR.COM Golden Bear is a leading provider of commercial property and casualty, professional liability, and residential earthquake insurance. Revenue: 20.8M$ Eployees: 82 Website: www.goldenbear.com mjhallandcompany.com Since 1973, M.J. Hall and Company has earned a name for dependable Business Insurance, as well as one of California's most experienced general agents. Revenue: 11.1M$ Eployees: 55 Website:www.mjhallandcompany.com |
| Lpa-group.com | · Apr 8, 2023 | LPA is a leading UK manufacturer in the design and build of connectors, LED lighting and electrical systems. Founded in the 1800’s, the Company has a long product development history where high reliability, low maintenance and life cycle costs are an intrinsic part of our product design and build ethos. All companies are ISO 9001 certified. Revenue: UK£19.3m |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .