Moneybird

MITRE
Malware Type:
Other
First seen:
Unknown
Last seen:
Unknown
Details:

[Moneybird](https://attack.mitre.org/software/S1137) is a ransomware variant written in C++ associated with [Agrius](https://attack.mitre.org/groups/G1030) operations. The name "Moneybird" is contained in the malware's ransom note and as strings in the executable.(Citation: CheckPoint Agrius 2023)

Associated Techniques (2)
ID ATT&CK Tactics
T1027.009 Embedded Payloads -
T1486 Data Encrypted for Impact -
Used by Actors (1)
Metadata
ID: 185
Created: 13/01/2026 17:48
Updated: 21/04/2026 04:00