Ransomware Revenue Surges 39% Year-on-Year as Cybercriminal Ecosystem Matures In the first quarter of 2026, ransomware groups generated an estimated $529.2 million a 39% increase compared to the same period in 2025, according to a report by cybersecurity firm Rapid7. The growth highlights the expanding sophistication and resilience of cybercriminal operations. Two prominent groups drove much of the revenue: Qilin amassed $193 million between July 2025 and March 2026, while Gentleman ransomware earned $52 million in the same period. The surge is attributed to the rise of initial access brokers (IABs), who sell compromised network access on dark web marketplaces, allowing ransomware operators to bypass the technical challenges of breaching systems themselves. Rapid7 likened ransomware groups to legitimate businesses, noting their ability to adapt and maintain operations despite disruptions. Unlike traditional enterprises, these criminal networks are designed to persist even if individual components such as servers or groups are dismantled, ensuring continuity through a decentralized ecosystem. The findings underscore the maturation of the cybercrime economy, where specialized services from access brokering to ransomware-as-a-service (RaaS) have lowered the barrier to entry, enabling even less technically skilled actors to launch attacks. The report suggests that the resilience of these operations poses a growing challenge for cybersecurity defenses.

Industrial Sector Hit Hardest by Ransomware Attacks, NCC Group Reports Industrial organizations faced 2,073 ransomware attacks in the 12 months leading up to March 2026, making the sector the most targeted industry during that period, according to data from NCC Group. On average, industrial firms accounted for 29.6% of all monthly ransomware activity, a surge attributed to vulnerabilities in operational technology (OT) environments systems that control physical industrial processes. The attacks disproportionately impacted capital goods businesses, with 1,192 incidents recorded in sectors involving machinery, equipment, and infrastructure. Machinery firms alone suffered 442 attacks, while construction and engineering companies faced 394. The trend suggests attackers are prioritizing industries where disruptions can halt production and destabilize supply chains. The rise in OT-focused attacks coincides with increased regulatory scrutiny under frameworks like the Network and Information Systems (NIS) Regulations, which mandate cybersecurity measures for essential services. Updated guidance under the Cybersecurity Act has further elevated expectations for OT governance, incident reporting, and supply-chain security, shifting OT security from a technical concern to a board-level compliance issue. A key challenge lies in the convergence of IT and OT systems, as industrial firms increasingly integrate production networks with corporate IT infrastructure. This connectivity expands the attack surface, allowing cyber incidents to spread rapidly from office systems into plant operations and critical infrastructure. Ray Robinson, OT Director at NCC Group, warned that many organizations still prioritize IT security over OT protection, despite the severe consequences of OT disruptions including production shutdowns, service outages, and safety risks. The impact extends beyond financial losses, particularly when attacks target essential services or public infrastructure. Legacy OT systems, often designed for reliability rather than cybersecurity, further complicate defenses. Many operators must balance production continuity with the need to modernize security controls, reporting, and supply-chain oversight all while addressing regulatory demands that now explicitly include OT environments. Katarina Sommer, Global Head of Government Affairs at NCC Group, noted that regulators are strengthening requirements, making OT security a critical governance priority for industrial businesses.