Ransomware groups grow revenue by almost 40% in Q1 2026


In the first quarter of the year, ransomware groups increased their revenue by almost 40%, compared to the same period last year. This is according to a new report from cybersecurity researchers Rapid7, who said the increase is partly due to a maturing cybercriminal industry.

Rapid7 based its findings on its research telemetry, which showed that in Q1 26, ransomware groups made an estimated $529.2 million. The Qilin ransomware group made an estimated $193 million between July 2025 and March 2026, while the Gentleman ransomware group made an estimated $52 million between July 2025 and March 2026, it was said.

Read more…
Source:  TechRadar News


Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox


Related:

  • Inside the murky world of hackers for hire

    April 8, 2017

    Shortly after Christmas, 2011, Ruby Nealon sold the Nintendo Wii games console his mother had bought him to fund an Open University course in computer software. He was 11 and it was the start of his unconventional education as a computer prodigy, which led him to drop out of school and start a full time degree ...

  • Finance firms to spend more on security as concern over cyber crime soars

    April 5, 2017

    Over 80pc of financial services firms plan to pump cash into cybersecurity this year, almost double that of last year as fears over cyber attacks swell. Corporate adviser Duff & Phelps, which analysed 200 executives in Europe, Hong Kong and the US, said 86pc of financial services firms intend to spend more time and money on cybersecurity this year. That’s a significant increase on last year, ...

  • Lazarus APT Spinoff Linked to Banking Hacks

    April 3, 2017

    The Lazarus Group, a nation-state level of attacker tied to the 2014 attacks on Sony Pictures Entertainment, has splintered off a portion of its operation to concentrate on stealing money to fund itself. The group, widely believed to be North Korean, has been linked to a February 2016 attack against the Bangladesh Central bank that resulted ...

  • New Mirai Variant Carries Out 54-Hour DDoS Attacks

    March 30, 2017

    A variant of the Mirai malware pummeled a U.S. college last month with a marathon 54-hour long attack. Researchers say this latest Mirai variant is a more potent version of the notorious Mirai malware that made headlines in October, targeting DNS provider Dyn and the Krebs on Security website. The IoT botnet behind the DDoS attacks ...

  • Ghana to set up national cyber security council

    March 30, 2017

    Ghana is to establish a national cyber security council to tackle the increasing rate of cyber crime in the country. The initiative is part of the government’s effort to build a comprehensive cyber security governance arrangement involving all key public and private sector stakeholders. The National Cyber Security Council will be an independent advisory body made ...

  • New Clues Surface on Shamoon 2’s Destructive Behavior

    March 27, 2017

    Researchers on Monday reported progress in piecing together some of the missing pieces of the Shamoon 2 puzzle that have been eluding them when it comes to lateral network movement and execution of the Disttrack malware component used in past campaigns. Shamoon 2 uses a combination of legitimate tools, such as the open source utility PAExec, and ...