Money Message Ransomware Recovery: Windows Encryptor and an ESXi Variant That Deletes Disks

Money Message appeared in 2023 and quickly became known for breaching the Taiwanese hardware maker MSI, an Asian airline and the US pharmacy provider PharMerica. ransomware.live counts about 36 victim claims, with new posts in September 2026.

Sophos and Acronis analysed the encryptor. The Windows version is a C++ program with an embedded JSON configuration that lists the folders to skip, the extension to add, the services and processes to kill and even domain credentials. It encrypts with ChaCha and ECDH and leaves the ransom note C:\money_message.log. Acronis notes that its encryption stage runs much more slowly than most ransomware.

The Linux variant, named esxi, is different: according to Sophos it deletes all the virtual hard disks on the host, which is closer to wiping than to encryption.

On Windows servers, keep the encrypted files: databases and backup files are often recoverable from their intact parts, and a slow encryptor interrupted early leaves more intact. On ESXi hosts where virtual disks were deleted, stop all writes to the datastore at once. Do not create new virtual machines, restore backups onto the same storage or reformat it: deleted data stays on the disks only until it is overwritten.

Contact us for a free assessment of the encrypted files and the affected storage. No data, no charge.