THREAT ACTOR
MONEY-MESSAGE_
ActiveMONEY-MESSAGE is a ransomware operator tracked through its public data-leak infrastructure. The group operates under the double-extortion model that defines the modern ransomware ecosystem: file encryption combined with the threat of stolen-data publication on a public leak site. It continues to post fresh victim claims as part of an ongoing extortion campaign.
For Ransomnews editorial coverage of MONEY-MESSAGE, including incident write-ups, attribution notes and additional context, see the Threat Groups archive or run a site search.
Victims by year
- 2026 8
- 2025 4
- 2024 6
- 2023 18
Leak site mirrors
29 mirrors tracked, 1 currently reachable. These are criminal-infrastructure URLs; links are deliberately not provided.
-
blogvl7tjyjvsfthobttze52w36wwiz34hrfcmorgvdzb6hikucb7aqd.onionNews snapshot · 2026-09-23 05:34 -
clientcuworpelkdwecucgvfhp5uz5n7uohsnokndrlhm2zkntyg3had.onionsnapshot · 2024-12-10 05:14 -
6xkylzxoxpd6bnl5ymhr6hysaoe3bsxzxhxpydhv22fmnt6m5zrlpvad.onionThe Egyptian Tax Authority (ETA) snapshot · 2026-06-09 08:04 -
l7eupjzxzfbsw7nxu7wu7lj2lzr5ulmyuyd4neyasbdmvzcedal7mmid.onionFirst Baptist Medical Center snapshot · 2026-06-09 08:02 -
qyk5o7wcgocwebnymjusnc7siyetwl7po26flw4e6hhg2xiue7brvmid.onionInsurance Agency Marketing Services snapshot · 2026-06-09 08:09 -
bolfkdkjbdig64ieqixpyhmquuadkm6nzohutbkfwgzftd35kipy45ad.onionAnna Jaques Hospital snapshot · 2026-06-09 08:34 -
742srdwxlwiu75kr3sbf6kzwjcxjwezvpi3s76ignhes3vqacvh3e4ad.onionTri-Way Manufacturing Technologies snapshot · 2026-06-09 08:00 -
nhdmgcysxuvvmd4dqwqisxumirvcj6xfhahuds5z7qgj7qlr3i73nnqd.onionToscana Promozione snapshot · 2026-06-09 08:27 -
jioj2j5k53vrhtdgvjmeijgkdxgwadzjacywnybjvqftbkqpt3oy6cid.onionMaxco Supply snapshot · 2026-06-09 08:29 -
372bkntomuk4xmevyki2gvpzdsm77xkhp4z6sctugcogqwgpqj4xkjyd.onionMD LOGISTICS snapshot · 2026-06-09 08:33 -
vycmr2wn5nqhkpla62mqe4vxh4fgdbc5id4g6piy4mvbjnb4mp4t25yd.onionTaylor University snapshot · 2026-06-09 08:07 -
jg7qeqdbqqordr5tazw5zc7s2h4sk2pt2hx4cxycqrcwr7vtpmreshad.onionRiverside Logistics snapshot · 2026-06-09 08:18 -
lhzaw2b2xn6lmtoioiswufyvjnrghlkmhtvwgsrsjnnmj2ceu56popqd.onionAiphone snapshot · 2026-06-09 08:34 -
d2vda7sp7rxuizyduwvnvccs3giddkwgglj5ecgrmdpu32grp2txjeqd.onionEstes Design & Manufacturing snapshot · 2026-06-09 08:20 -
26kbddrpm2xfjg4unow76xyvrffwh4usqjhsqgalf4h3diiujy75ngqd.onionsnapshot · 2024-12-10 05:19 -
moze6ryu3ev65tgmssb4sckagkgfzmjtsxg2d6xrjjua2dke5lagcxqd.onionsnapshot · 2024-12-10 05:19 -
au6l74lej2qvwrvasdyc5ta4g7jdshjwkzbi635g6uztld2n2fcacyad.onionsnapshot · 2024-12-10 05:20 -
wzu6yixpcohxeeunakzqf42dothwikt3gvtovamxdm6rfl3oe6smywyd.onionsnapshot · 2024-12-10 05:20 -
p6kxp556kkcbjdjsg24g3edmvr7v7ujecuychw4ibvqhl6wuomnrgbqd.onionsnapshot · 2024-12-10 05:20 -
z46mj5ihckzwf2ons46ceryjwyxt3ctrqyglmre5uhnipvoepaciulid.onionsnapshot · 2024-12-10 05:21 -
vkge4tbgo3kfc6n5lgjyvb7abjxp7wdnaumkh6xscyj4dceifieunkad.onionsnapshot · 2024-12-10 05:21 -
3w3uuz4vze6wdwxrebn3oaavft47xtvghl7qcmpqclgojr44muaigwyd.onionsnapshot · 2024-12-10 05:21 -
client372kkzvqpgniqp6r5rqkg22yrlhstxiaxskeowp2hrperdelad.onionsnapshot · 2024-12-12 11:57 -
xq5t7xwptmpoxzjkns7wfbbr43zxedm6ygbfsh6bp6lipvyhzkfopjyd.onionNational Atomic Energy Commission snapshot · 2026-06-09 08:33 -
pdndkkg2hu4z36yhrbgtycxf52iodlh5os4argm2ooia4ypwgnvlzgqd.onionKazyon snapshot · 2026-06-09 08:05 -
md7a4mzsppjuaw4zczoojpo7arqrlnmhlqoo35ttrc7l2lpeiblx2yqd.onionMarina Family Medical snapshot · 2026-06-09 08:22 -
l4wvjhcng4klrah4gldyyvo3x5p5o4frzbvwdhzqa6vkg2chistqj3yd.onionThe Tech Interactive snapshot · 2026-06-09 08:28 -
d26nwzgwylb3no3ar3rt3si3e3ujzndhp5wryxxlr76wba5snhap3tyd.onionYoung Adjustment Company snapshot · 2026-06-09 08:18 -
z33ua54qzvzyxtbe5oghqyvxfs5orftqlws3w5ndrtsvmaldcvbyf5ad.onionBucks County Opportunity Council, INC. snapshot · 2026-02-05 18:00
Recent victims
The 50 most recent victims claimed by MONEY-MESSAGE. Total in the index: 36.
| Date listed | Victim | Description |
|---|---|---|
| 2026-09-21 | U.S. Electrical Services and Wiedenbach Brown | |
| 2026-08-28 | ProCare | |
| 2026-07-25 | Yourway Transportation | |
| 2026-07-23 | Indigo Energy | |
| 2026-07-09 | Envision Unlimited | |
| 2026-07-02 | X-Copper Professional | |
| 2026-05-12 | Forestdale | |
| 2026-01-28 | Family Partnerships of Central Florida | |
| 2025-08-04 | Bucks County Opportunity Council, INC. | |
| 2025-07-15 | Young Adjustment Company | |
| 2025-04-18 | The Tech Interactive | |
| 2025-01-18 | Marina Family Medical | |
| 2024-12-18 | National Atomic Energy Commission | |
| 2024-12-13 | Kazyon | |
| 2024-11-17 | The Egyptian Tax Authority (ETA) | |
| 2024-06-19 | First Baptist Medical Center | |
| 2024-05-16 | Insurance Agency Marketing Services | |
| 2024-01-19 | Anna Jaques Hospital | |
| 2023-10-12 | Tri-Way Manufacturing Technologies | |
| 2023-10-03 | Toscana Promozione | |
| 2023-10-03 | MD LOGISTICS | |
| 2023-10-03 | Maxco Supply | |
| 2023-09-03 | Riverside Logistics | |
| 2023-09-03 | Estes Design & Manufacturing | |
| 2023-09-03 | Aiphone | |
| 2023-09-02 | Taylor University | |
| 2023-07-14 | Propper International | |
| 2023-07-14 | Meteksan Defence Industry | |
| 2023-05-13 | Aspen Dental Management Inc. | Aspen Dental Management, Inc. is an American dental support organizati… |
| 2023-04-08 | Biman airlines | Biman Bangladesh Airlines (Bengali) is the national flag carrier airl… |
| 2023-04-08 | Hawaii self storage | Hawaii Self Storage is a locally owned company, committed to service … |
| 2023-04-08 | Pharmerica.com & BrightSpring Health Services | Headquartered in Louisville, Kentucky, PharMerica is one of the larges… |
| 2023-04-08 | Micro Star International | Micro-Star International AKA MSI designs, manufactures, and sells mot… |
| 2023-04-08 | midamericanglass.com | Mid-American Glass is a regional distributor / fabricator of flat gla… |
| 2023-04-08 | Goldenbear.com & mjhallandcompany.com | GOLDENBEAR.COM Golden Bear is a leading provider of commercial propert… |
| 2023-04-08 | Lpa-group.com | LPA is a leading UK manufacturer in the design and build of connector… |
CONFIRMED ATTACKS
Money Message confirmed attacks: 12 verified incidents
Ransomnews has verified 12 Money Message incidents against named organisations, each corroborated by a public source such as a breach notification, regulatory filing or press report. The confirmed record runs from March 2023 to June 2026. United States accounts for 9 of them (75%), with victims recorded in 4 countries in total. The most affected sector is healthcare, at 3 confirmed victims. Where a figure was disclosed (7 cases), these incidents account for 6,483,357 exposed records.
Confirmed victims by year
Most affected sectors
Most affected countries
Verified Money Message incidents
| Date | Organisation | Sector | Location | Records | Ransom paid | Source |
|---|---|---|---|---|---|---|
| June 2026 | X-Copper Professional Corporation | Legal | Markham, Canada | — | Unknown | Source |
| December 2025 | Community Based Care Brevard dba Family Partnerships of Central Florida | Other | Florida, United States | 96 | Unknown | Source |
| August 2025 | Bucks County Opportunity Council | Other | Pennsylvania, United States | — | Unknown | Source |
| November 2024 | Comisión Nacional de Energía Atómica (CNEA) | Government | Buenos Aires, Argentina | — | Unknown | Source |
| March 2024 | Insurance Agency Marketing Services, Inc. | Finance | Nebraska, United States | 68,074 | Unknown | Source |
| December 2023 | Anna Jaques Hospital | Healthcare | Massachusetts, United States | 316,342 | Unknown | Source |
| October 2023 | Maxco Supply | Manufacturing | California, United States | — | Unknown | Source |
| July 2023 | Aiphone Corporation | Manufacturing | Washington, United States | 553 | Unknown | Source |
| May 2023 | Taylor University | Education | Indiana, United States | 811 | Unknown | Source |
| April 2023 | The Aspen Group (Aspen Dental Management, Inc.) | Healthcare | Illinois, United States | 62,183 | Unknown | Source |
| April 2023 | Micro-Star International (MSI) | Manufacturing | New Taipei City, Taiwan | — | Unknown | Source |
| March 2023 | PharMerica (BrightSpring Health) | Healthcare | Kentucky, United States | 6,035,298 | Unknown | Source |
Claimed vs confirmed. The figures above the fold on this page come from Money Message's own leak-site postings and reflect what the operation claims. The table here is a separate evidence class: incidents Ransomnews verified against a public source. Confirmed counts are lower than claimed counts by design: most victims never disclose, and some leak-site listings are recycled, exaggerated or fabricated. Records and ransom figures are shown only where a named source disclosed them. See the full ransomware statistics or the Ransomtracker dataset.