Ransomware resurgence surges as Lockbit and splintered Conti factions dominate the threat landscape
The global cybersecurity landscape is currently navigating a volatile period of transition as ransomware-as-a-service (RaaS) operations undergo a significant restructuring, leading to a marked increase in successful digital extortion campaigns. According to the latest monthly threat intelligence report from the NCC Group, July saw a 47 percent surge in ransomware activity compared to the previous month, with a total of 198 recorded incidents. While this figure remains below the record-breaking levels observed in early spring, the data highlights the aggressive persistence of sophisticated cybercriminal syndicates, most notably the Lockbit group and the fragmented remnants of the notorious Conti organization.
The Dominance of Lockbit 3.0
At the forefront of this malicious activity is Lockbit, which has solidified its status as the most prolific ransomware operator currently in existence. By actively monitoring the underground leak sites utilized by various threat actors, researchers have confirmed that Lockbit was responsible for 62 successful attacks in July alone. This figure represents an increase of ten attacks over June’s performance and establishes the group as a formidable force that accounts for more than double the combined output of its nearest competitors.
Lockbit’s latest iteration, branded as Lockbit 3.0, has demonstrated a high degree of operational maturity. By employing an efficient RaaS model, the group recruits affiliates to perform the manual work of breaching networks, deploying payloads, and negotiating ransoms, while the core developers maintain the infrastructure and encrypting software. Security analysts have characterized Lockbit 3.0 as a critical threat to organizations across all sectors, urging IT security teams to prioritize the hardening of their defenses against this specific strain of ransomware. The group’s ability to scale its operations—coupled with its frequent updates to its malicious toolkit—suggests that its foothold in the digital ecosystem will remain stable for the foreseeable future.
Chronology of a Shifting Landscape
The current surge in attacks is best understood through the lens of recent geopolitical and law enforcement pressure. Earlier this year, the ransomware ecosystem experienced a period of relative instability, peaking at nearly 300 campaigns per month during March and April. However, the subsequent months saw a brief, localized decline in activity, which many experts attributed to the disarray within established criminal hierarchies.
The primary catalyst for this disruption was the aggressive intervention by the United States government. In May 2022, the U.S. Department of State issued a formal reward offer of up to $15 million for information leading to the identification and localization of key members of the Conti ransomware group. At the time, Conti was widely considered the most dangerous and sophisticated threat actor in the world, having systematically targeted critical infrastructure and healthcare systems.
The bounty, coupled with increased international scrutiny, forced the Conti organization to dissolve its central command structure. However, the vacuum created by its departure was short-lived. Rather than vanishing, the highly skilled operatives associated with Conti simply migrated to new or existing platforms. This transition period, which lasted roughly two months, appears to have concluded. The recent uptick in July, according to NCC Group, represents the "settling in" period where these displaced actors have resumed operations under new banners, effectively re-entering the threat landscape with renewed vigor.
The Rise of Hiveleaks and BlackBasta
The most significant development in the post-Conti era is the rapid ascent of groups that demonstrate clear operational ties to the former syndicate. Among these, Hiveleaks and BlackBasta have emerged as the primary successors to the Conti legacy.
Hiveleaks, which recorded 27 attacks in July, experienced a staggering 440 percent increase in activity compared to the previous month. Similarly, BlackBasta reported 24 attacks, marking a 50 percent increase over its June figures. Analysts have identified these groups as having deep, structural associations with the defunct Conti gang. Hiveleaks is currently operating as a high-volume affiliate, utilizing existing infrastructure to launch widespread campaigns, while BlackBasta appears to be a direct evolution of the Conti codebase, adopting the group’s proven techniques for exfiltration and extortion.
This transition highlights a growing trend in cybercrime: the "rebranding" of ransomware gangs. By shedding the baggage associated with a high-profile name like Conti, these operators can bypass certain law enforcement monitoring lists and re-establish their reputation with affiliates, all while continuing to leverage the same technical expertise and compromised credentials that made them successful in the first place.
Fact-Based Analysis of Operational Trends
The data provided by the NCC Group serves as a critical indicator of the current state of cybersecurity. The correlation between the dismantling of Conti and the subsequent rise of new, smaller groups suggests that the RaaS model is highly resilient to external pressure. When a central group is targeted, the ecosystem does not collapse; instead, it atomizes into smaller, more agile units that are arguably harder to track and neutralize.
From a technical perspective, these groups are increasingly moving away from simple encryption-only attacks. Modern ransomware campaigns now prioritize the theft of sensitive data before the encryption phase begins—a technique known as "double extortion." This ensures that even if an organization has robust backup systems and can restore its operations without paying a ransom, the attackers still hold leverage through the threat of leaking proprietary or private information on public-facing sites.
Furthermore, the rapid growth of these groups indicates that the barrier to entry for affiliates remains low. By lowering the technical requirements for entry-level hackers, Lockbit and the Conti-adjacent groups are effectively crowdsourcing cybercrime. The primary implication for the private sector is that the attack surface has expanded significantly; an organization is no longer just defending against a single, identifiable group, but rather a sprawling network of affiliates who may employ a variety of different TTPs (Tactics, Techniques, and Procedures).
Implications for Organizations and Policy
The resurgence in ransomware activity carries profound implications for organizational security postures. The shift from a single, dominant threat actor (Conti) to a diverse, multi-group landscape means that standard security protocols—such as relying on specific indicator-of-compromise (IoC) lists—are becoming less effective. Defenders must shift their focus toward behavioral analytics and proactive threat hunting.
Official responses from global cybersecurity agencies, such as CISA (Cybersecurity and Infrastructure Security Agency) and the UK’s NCSC, have emphasized the necessity of a "zero trust" architecture. As attackers become more adept at living off the land—using legitimate administrative tools to conduct malicious activity—traditional perimeter defenses are no longer sufficient. Organizations are being urged to implement multi-factor authentication (MFA), network segmentation, and rigorous patch management programs to mitigate the risk of initial entry.
Looking ahead, the NCC Group researchers have warned that the current trends are likely to continue or even accelerate as we move into the final quarter of the year. The structural changes that occurred during the summer months have effectively optimized the ransomware business model for the current threat environment. As these new factions solidify their operations, it is anticipated that their total number of successful compromises will continue to rise.
Conclusion
The current state of the ransomware ecosystem is characterized by both continuity and evolution. While the names of the groups may change, the fundamental threat to global enterprises remains constant. Lockbit’s continued dominance, combined with the successful pivot of Conti-affiliated actors into new identities, underscores the necessity of a global, coordinated response to cybercrime. As the industry looks toward the coming months, the focus must shift from reactive mitigation to proactive, intelligence-led defense. Without a significant shift in the efficacy of international enforcement and corporate cybersecurity maturity, the cycle of extortion and resurgence is likely to persist, leaving organizations in a state of perpetual high alert.
