Ransomware groups grow revenue by almost 40% in Q1 2026

Date:
Tue, 02 Jun 2026 12:12:42 +0000

Description:
Initial Access Brokers are removing a major pain point helping ransomware operators steal more.

FULL STORY ======================================================================Copy link Facebook X Whatsapp Reddit Pinterest Flipboard Threads Email Share this article 0 Join the conversation Follow us Add us as a preferred source on Google Newsletter Subscribe to our newsletter Ransomware revenue rose nearly 40% year-on-year Groups leverage dark web access brokers Criminal operations show surprising resilience In the first quarter of the year, ransomware
groups increased their revenue by almost 40%, compared to the same period
last year. This is according to a new report from cybersecurity researchers Rapid7, who said the increase is partly due to a maturing cybercriminal industry.

Rapid7 based its findings on its research telemetry, which showed that in Q1 26, ransomware groups made an estimated $529.2 million. The Qilin ransomware group made an estimated $193 million between July 2025 and March 2026, while the Gentleman ransomware group made an estimated $52 million between July
2025 and March 2026, it was said. Compared to Q1 25, thats a 39% increase,
and is partly due to ransomware operators having an easier time accessing their targets infrastructure. Latest Videos From Watch full video here: You may like Big Game Hunters: UK ransomware volume drops significantly 'but the reality is more alarming' big orgs are being hit harder and with greater success Experts warn ransomware hackers will often lower their prices - with some giving discounts up to 96% Sophos report warns new "WantToCry"
ransomware could pose a major risk Resilient operations The revenue growth reflects the rise of initial access brokers, which has shifted cybercrime
from technically specialised malware development to a mature underground marketplace where access, tooling, and full attack services are now commercially available to almost anyone, Rapid7 said in a press release
shared with TechRadar Pro.

In other words, instead of working to break into their targets networks, ransomware groups just buy access on a dark web marketplace, from someone
whos already done the heavy lifting for them.

Rapid7 also compares ransomware operators to legitimate businesses, saying that no FTSE 350 organization achieved the same results (which makes sense, otherwise criminals would do legitimate business, instead). However, the researchers hinted that legitimate businesses have a lot to learn from ransomware groups, specifically in business resilience:

The problem is they are demonstrating, very publicly, that ransomware can be
a successful criminal enterprise, and ironically, in some ways, theyre more resilient than businesses themselves, said Thom Langford, CTO EMEA at Rapid7. Removing one group, one server, or one piece of infrastructure rarely collapses the wider operation because the ecosystem is designed to keep functioning around the damage. Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed! Contact me with news
and offers from other Future brands Receive email from us on behalf of our trusted partners or sponsors By submitting your information you agree to the Terms & Conditions and Privacy Policy and are aged 16 or over. The best antivirus for all budgets Our top picks, based on real-world testing and comparisons

Read our full guide to the best antivirus 1. Best overall: Bitdefender Total Security 2. Best for families: Norton 360 with LifeLock 3. Best for mobile: McAfee Mobile Security Follow TechRadar on Google News and add us as a preferred source to get our expert news, reviews, and opinion in your feeds.



======================================================================
Link to news story: https://www.techradar.com/pro/security/ransomware-groups-grow-revenue-by-almos t-40-percent-in-q1-2026


--- Mystic BBS v1.12 A49 (Linux/64)
* Origin: tqwNet Technology News (1337:1/100)