Loading story…
Google reported paying $17.1 million to 747 security researchers in 2025 through its Vulnerability Reward Program (VRP), bringing total payouts since 2010 to $81.6 million; the highest single reward in 2025 was $250,000. Google also highlighted expansion of bounty coverage into newer areas, including an AI Vulnerability Rewards Program, new Chrome VRP reward categories for AI-related bugs, and a rewards program tied to OSV-SCALIBR for identifying flaws in software dependencies.
Separately, a Chainalysis report cited by KnowBe4 said ransomware attacks increased 50% in 2025 even as observed on-chain ransom payments declined 8% YoY to $820 million (with the caveat that attribution updates could push the total toward or above $900 million). Chainalysis also reported that while fewer victims paid, the average payment among those who did rose 368% YoY to nearly $60,000, and assessed that ransomware operators continued to evolve extortion tactics to increase leverage and impact beyond direct cryptocurrency payments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
Google said it paid more than $17 million to 747 security researchers through its Vulnerability Reward Program in 2025, the highest annual total since the program began. The company also said its 2025 efforts included new AI-related reward categories and additional bounty programs, with the top single reward reaching $250,000.
Chainalysis found that ransomware attacks increased by 50% in 2025, while the share of victims paying ransoms dropped to an all-time low. It recorded more than $820 million in on-chain ransomware payments for 2025, down from an updated 2024 estimate of $892 million, while noting the final 2025 total could rise as attribution improves.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Chainalysis’ 2026 Crypto Crime Report** assessed the 2025 ransomware economy and found that **on-chain ransomware payments fell ~8% year-over-year to about $820M**, even as **claimed attacks increased ~50%**. The report also observed a sharp rise in the **median ransom payment** (to roughly **$60K**, up several-fold from 2024), suggesting attackers are concentrating on larger, higher-value victims even as fewer victims pay overall. Chainalysis highlighted **Initial Access Broker (IAB)** activity as a potential leading indicator, noting that spikes in IAB-related inflows often **precede increases in ransomware payments and victim leak activity by ~30 days**, and it described increasing convergence in the “enablement” layer (e.g., shared use of **bulletproof hosting** and **residential proxy** services) across financially motivated and state-linked actors. Recorded Future News’ *The Record* reported additional metrics from the same Chainalysis analysis, including that the **victim payment rate dropped to a record low (~28%)** and that the $820M figure may rise toward **~$900M** as attribution improves (mirroring how 2024 totals increased after initial reporting). The article attributed the divergence between rising incident volume and falling payments to improved incident response, increased regulatory scrutiny discouraging payments, and law-enforcement disruption that has fragmented major ransomware operations into smaller groups—some using poorly designed malware that can be addressed with decryptors. Other items provided (a UAE claim of thwarting a “terrorist” ransomware campaign and a CSIS incident timeline covering multiple unrelated 2025 events) are not part of the Chainalysis 2025 ransomware-payment findings and do not materially corroborate that specific report’s conclusions.
Jun 29, 2026
Blockchain and incident-response reporting indicates ransomware victims are paying less often even as attackers claim more victims. Chainalysis data cited by *BleepingComputer* puts the 2025 victim payment rate at **28%** (down from **62.8%** in 2024 and **78.9%** in 2022) while noting a roughly **50% year-over-year increase** in claimed attacks; on-chain ransomware payments for 2025 were estimated at **$820M** with the expectation the total could approach or exceed **$900M** as additional attributions are made. Despite lower overall payment participation, the **median ransom payment increased** sharply (reported as up **368%**, from **$12,738** in 2024 to **$59,556** in 2025), alongside greater ecosystem fragmentation (Chainalysis observed **85 active extortion groups**), with drivers including improved incident response, regulatory scrutiny, law-enforcement actions, and market dynamics. Separately, the UAE Cyber Security Council said it **thwarted** an attempted ransomware operation targeting national digital infrastructure and “vital sectors,” describing activity that included network intrusion attempts, ransomware deployment efforts, and systematic phishing, and alleging the use of **AI-enabled tooling** to increase sophistication. Broader incident tracking also highlights the continued real-world impact of ransomware and extortion: CSIS summarized multiple 2025 cases including **Medusa**’s claimed breach of **SimonMed Imaging** (reported ~**1.2M** patients affected; **$1M** demand to delete data) and a ransomware-enabled breach of UK defense contractor **Dodd Group** attributed to **Lynx** (reported ~**4TB** stolen and subsequent leaking), underscoring that even with declining payment rates, high-impact data theft and extortion remain persistent risks.
Jun 29, 2026
The US Treasury Department's Financial Crimes Enforcement Network (FinCEN) released a comprehensive report analyzing ransomware activity and payments from January 2022 to December 2024. The report revealed that over this three-year period, organizations reported 4,194 ransomware incidents and paid more than $2.1 billion in ransoms, nearly matching the $2.4 billion paid over the previous nine years. Ransomware payments peaked in 2023 at approximately $1.1 billion, followed by a significant decline to $734 million in 2024, a drop attributed to major law enforcement actions against prominent ransomware groups such as ALPHV/BlackCat and LockBit. Despite the decrease in payments, the number of reported incidents only slightly declined, indicating that while attacks remain frequent, fewer victims are paying ransoms. The report highlighted that the manufacturing, financial services, and healthcare sectors were the most targeted, with financial institutions suffering the largest monetary losses. The vast majority of ransom payments (about 97%) were made in Bitcoin, and most funds were laundered through unregulated cryptocurrency exchanges. The median ransom payment peaked at $174,000 in 2023 before dropping to $155,257 in 2024. The data underscores the evolving nature of the ransomware threat landscape and suggests that coordinated law enforcement efforts can have a measurable impact on the financial incentives driving ransomware operations.
Jun 29, 2026