Ransomware Revenue Growth Tops FTSE 350 in Q1

Rapid7 Labs found ransomware groups earned an estimated $529.2 million in the first quarter of 2026, a 39% year-over-year increase. No FTSE 350 company reported revenue growth above 30% in the same quarter.

Rapid7’s analysis shows that much of the revenue growth is concentrated among a small number of groups. The Qilin group generated an estimated $193 million between July 2025 and March 2026. The Gentleman group produced about $52 million over the same period.

Researchers identified an underground market for access and services as a driver of the trend. Initial access brokers sell entry to compromised systems. Buyers can purchase tooling, malware or complete attack services, allowing different operators to specialize in access, deployment or extortion.

The report states that infrastructure used in attacks — compromised servers, leak sites and negotiation portals — can be rebuilt quickly after disruption. Rapid7 says law enforcement takedowns can remove parts of operations, but the broader ecosystem often continues to function around those losses.

Thom Langford, Rapid7’s chief technology officer for EMEA, described the groups as ‘highly efficient businesses’ and noted that removing one component rarely collapses the network.

Rapid7 recommends that organizations continuously reduce exposed attack surface by fixing misconfigurations, monitoring isolated assets and addressing internet-facing vulnerabilities. The firm advises security teams to use threat intelligence to map attacker behavior, tooling and infrastructure, and to track access pathways before they lead to ransomware incidents.

The report also calls for a shift to preventing credential and access compromise. Suggested measures include enforcing least privilege for accounts, implementing stronger identity controls and monitoring for early indicators of credential resale or misuse in underground markets. Langford called for earlier detection and intervention: ‘To give ransomware groups the economic crash they deserve, we need to shift to earlier visibility and earlier action.’