What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Fewer victims in Coveware’s dataset paid a ransom in Q3 2025 than in early 2024, but that does not prove ransomware criminals’ total profits are falling. Coveware recorded a 23% payment rate in Q3 2025, while later figures show payment amounts and separate estimates of group revenue moving in different directions. The clearest finding is that payment frequency fell; the broader profit trend remains unsettled.
What does “profits declining” mean in this report?
The headline claim needs a distinction: a victim’s decision to pay, the amount paid, total criminal revenue, and net profit after operating costs are different measures. Coveware’s quarterly figures describe payments in cases it observed; they are not audited accounts of ransomware groups’ income or expenses. Its analysis that “shrinking profits are driving greater precision” is an interpretation of the criminal business model, not a measured net-profit series. Coveware’s Q3 2025 report provides the underlying payment figures.
What did Coveware find in Q3 2025?
In Coveware’s observed cases, 23% of victims paid in Q3 2025, down from 28% in Q1 2024. That comparison indicates a lower share of victims paying in those datasets, not a census of all ransomware incidents. Coveware reported a Q3 2025 average payment of $376,941, down 66% from Q2, and a median payment of $140,000, down 65% from Q2.
Average and median tell different stories
The average is the total of observed payments divided by the number of paying cases; a few very large payments can pull it upward. The median is the midpoint payment, with half of observed payments above and half below. Coveware’s Q3 2025 average was $376,941, while its median was $140,000. The two figures are not interchangeable, and the median better describes the middle payment in that dataset.
Why the later figures complicate a simple decline
Coveware by Veeam reported a 23% payment rate in Q1 2026, with an average payment of $680,081 and a median of $300,750. In Q2 2026, the payment rate reached a new record low, but the average payment rose 176% from Q1 to $1,880,612 while the median fell 50% to $150,000. Coveware by Veeam’s quarterly reports attribute the unusually high Q2 average to a handful of large data-exfiltration payments, including targeted cases against law firms.
This is a useful example of why payment frequency and payment size should be tracked separately. Fewer observed victims may pay while a small number of exceptionally large payments push the average higher. In Q2 2026, the average and median moved in opposite directions, so neither number alone describes the whole pattern.
Does a separate revenue estimate show profits rising?
Rapid7 estimated ransomware-group revenue at $529.2 million in Q1 2026, up 39% year over year, according to TechRadar Pro’s June 2, 2026 report. That estimate is not directly comparable with Coveware’s per-case average and median payments: the sources use different measures and methods. It is evidence against treating a decline in Coveware’s payment rate as proof that all ransomware revenue—or net profit—has declined.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Why might ransomware operators change their tactics?
Coveware argues that ransomware operations face costs that can reduce margins: affiliates take a share, while access brokerage, data storage, harassment, and leak-site infrastructure add overhead. It also describes a shift toward more selective approaches, including targeted social engineering and insider methods. These points explain Coveware’s interpretation of pressure on profits; they are not an independently audited accounting of criminal costs or margins.
Quick Recap
Rank #4
Rank #3
What can readers conclude?
- Payment frequency fell: Coveware’s observed payment rate was 23% in Q3 2025, compared with 28% in Q1 2024.
- Payment amounts are volatile: In Q2 2026, the average rose sharply while the median fell, reflecting the influence of a few large cases.
- Total revenue is a separate question: Rapid7’s Q1 2026 estimate rose year over year, but it uses a different measure from Coveware’s case-level payments.
- Net profits remain unproven: The available figures do not establish whether total ransomware profits across criminal groups are declining.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
