Demystifying Money Message Ransomware

Money Message is a recently observed double-extortion ransomware strain (affecting Windows and Linux) that harvests or embeds admin credentials to access and encrypt network shares, uses ECDH key exchange with ChaCha cipher for file encryption, stops backup/services, deletes VSS snapshots, and publishes stolen data on a leak site if ransoms are unpaid; the report includes technical details, hashes (IOCs), and a Yara rule to detect the Windows sample.