The search giant created thousands of virtual victims of ransomware to expose the payment ecosystem surrounding the malware type.
Most of the money was made in 2016 as gangs realised how lucrative it was, revealed a talk at Black Hat.
Two types of ransomware made most of the money, it said, but other variants are starting to emerge.
Track and trace
"It's become a very, very profitable market and is here to stay," said Elie Bursztein from Google who, along with colleagues Kylie McRoberts and Luca Invernizzi, carried out the research.
Ransomware is malicious software that infects a machine and then encrypts or scrambles files so they can no longer be used or read. The files are only decrypted when a victim pays a ransom. Payments typically have to be made using the Bitcoin virtual currency.