Speculation, but could some of the new money be coming from CryptoLocker[0]?
[0] http://www.bleepingcomputer.com/virus-removal/cryptolocker-r...