moneymessage

Firma de detección defensiva para este grupo (úsala en tu EDR/SIEM). Fuente: ransomware.live.

/*
Money Message ransomware
*/

rule MoneyMessage_Ransomnote
{
    meta:
        author = "ransomware.live"
        family = "ransomware.moneymessage"
        description = "Detects Money Message ransomware note"
        date = "2026-05-04"
        severity = 7
        score = 70

    strings:
        $s1 = "money_message.log" ascii nocase
        $s2 = "money message" ascii nocase
        $s3 = ".money_message" ascii
        $s4 = "MoneyMessage" ascii nocase

    condition:
        any of them
}

Your files was stolen by "Money message" profitable organization.
Dear managers and founders of the company!
Your business uses the possibilities of modern information technologies for its own brand and business reputation, which results in an increase in sales of insurance services and the attraction of both new and existing customers.
Our specialists found that your company did not have sufficient protection against the leakage of personal data. You have neglected the trust of your customers and the laws of the United States, which regulate the full protection of personal data and confidential information of clients. To run your business, you need to build the right security system. We have found flaws in your defense, so we offer you, relatively for a certain amount, to resolve your issue and preserve your reputation.
So, how much data we have? More than 500Gb. Starting with office documents and ending with open and closed cases. All data is in our storage. You can get it as soon as we make a common decision in the chat.
Referring to US law, we can say that you will suffer large losses due to leaks of personal information, such as SSN(social security number), client’s place of registration, driver license, phone number, email and many others.We received this information from your  servers .You can find out how much personal information we have by communicating with us via Tor, the link will be provided.
In case you refuse to pay, we will post the files we stole from your internal network, in our blog:
[redactado]
If you think that only your documents were leaked, then you are mistaken, we also found documents from your employees from other companies, signed by other employees.
We can give an example of a case where a company did not take care of an information leak and suffered losses due to lawsuits
-[redactado]
-[redactado]
For further negotiations open this [redactado]
using tor browser [redactado]

• https://www.ransomware.live/group/moneymessage