Lockbit Dominates a Resurgent Global Ransomware Landscape as Conti Offshoots Reorganize

The global cybersecurity landscape is currently witnessing a significant resurgence in ransomware activity, marked by a sharp 47 percent increase in successful campaigns during July 2022 compared to the previous month. Data synthesized by the NCC Group indicates that this uptick, while not yet reaching the record-breaking levels observed in the spring of this year, signals a period of rapid tactical realignment among major cybercriminal syndicates. At the forefront of this surge is Lockbit, which has solidified its position as the world’s most prolific ransomware-as-a-service (RaaS) operator, while former affiliates of the now-fractured Conti group have begun to aggressively re-emerge under new operational banners.

The July Surge: Statistical Breakdown and Market Leaders

According to the latest Threat Pulse report, researchers recorded 198 successful ransomware attacks in July, a substantial recovery from a mid-year dip in activity. This rebound brings the total volume of attacks back into the high-frequency range, though it remains notably lower than the peaks observed in March and April, which saw nearly 300 campaigns each.

Lockbit, specifically the updated Lockbit 3.0 iteration, is currently the undisputed leader in the ransomware ecosystem. In July alone, the group was responsible for 62 confirmed attacks, a figure that represents ten more incidents than the previous month and a total that dwarfs its competitors. To put the scale of Lockbit’s operations into perspective, they are responsible for more than double the number of attacks compared to the second and third most prolific groups combined. Security analysts have characterized Lockbit 3.0 as a sophisticated, high-velocity threat that organizations must prioritize in their defensive posture.

Trailing Lockbit in the threat landscape are Hiveleaks and BlackBasta, both of which have demonstrated alarming growth trajectories. Hiveleaks reported 27 attacks in July, marking an astounding 440 percent increase from June. Similarly, BlackBasta accounted for 24 attacks, representing a 50 percent month-over-month rise. These figures suggest that the ransomware market is not only becoming more active but is also undergoing a rapid consolidation of power among a few highly efficient threat actors.

The Collapse of Conti and the Birth of New Affiliates

The recent volatility in the ransomware market can be traced directly to the structural breakdown of the Conti organization. For much of 2021 and early 2022, Conti was widely regarded as the most dangerous ransomware gang in existence, known for its professionalized hierarchy, extensive resources, and devastating attacks on critical infrastructure. However, the group’s stability was undermined by a combination of internal leaks—following the group’s public alignment with the Russian state—and aggressive international law enforcement interventions.

In May 2022, the United States Department of State significantly escalated its pressure on the group by offering a reward of up to $15 million for information leading to the identification or conviction of key leadership figures within the Conti syndicate. This multi-million dollar bounty, coupled with increased scrutiny from global intelligence agencies, appears to have served as the catalyst for the group’s formal dissolution.

Analysts now believe that the rise of Hiveleaks and BlackBasta is a direct byproduct of this collapse. By transitioning from a centralized, monolithic organization into smaller, more agile units, former Conti members are effectively evading the direct heat of international law enforcement while maintaining their core technical capabilities. Hiveleaks has emerged as an affiliate-driven model, while BlackBasta has surfaced as a successor strain, utilizing similar encryption tactics and extortion methodologies that defined the original Conti operation. The fact that these groups have managed to return to the threat landscape so quickly suggests that the human capital behind these attacks—the developers, negotiators, and access brokers—remains largely intact and highly motivated.

Chronology of a Shifting Threat Environment

The current state of the ransomware industry is best understood through a timeline of its recent evolution:

• Early 2022: Conti maintains its dominance, targeting high-value organizations and government entities with impunity.
• February 2022: The internal discord within Conti begins to surface, punctuated by the "ContiLeaks" incident, where internal chat logs were released to the public.
• March–April 2022: The ransomware market hits a peak of nearly 300 attacks per month as gangs attempt to maximize revenue before potential shifts in the geopolitical climate.
• May 2022: The U.S. State Department formalizes its $15 million reward program for Conti leadership, effectively forcing the group to fracture.
• June 2022: A temporary decline in recorded attacks occurs as threat actors pause operations to reorganize, rebrand, and establish new infrastructure.
• July 2022: The "resurgence" period begins. Groups like Lockbit aggressively expand their market share, while Conti-linked entities (Hiveleaks and BlackBasta) return to operational capacity.

Implications for Corporate and Public Infrastructure

The structural changes observed in the ransomware ecosystem have profound implications for enterprise security. The shift from a single, dominant "super-group" like Conti to a fragmented landscape of smaller, highly competitive entities suggests that the frequency of attacks is likely to remain high.

When ransomware groups compete for "market share" in terms of successful compromises, they often resort to more aggressive tactics. This includes shorter negotiation windows, the adoption of double-extortion techniques—where data is both encrypted and exfiltrated for potential publication—and the targeting of third-party supply chain vulnerabilities. As these groups settle into their new operational modes, security professionals are observing a pattern of increased total compromises, confirming that the threat is not merely changing shape but is becoming more pervasive.

Furthermore, the longevity of these groups is bolstered by the RaaS model, which lowers the barrier to entry for lower-skilled cybercriminals. By providing the encryption software and the platform for negotiations, groups like Lockbit allow "affiliates" to conduct sophisticated attacks without requiring deep knowledge of malware development. This democratization of cybercrime ensures that even as individual groups are disrupted, the underlying network of malicious activity remains resilient.

Expert Perspectives and Defensive Strategy

Security experts emphasize that while the identity of the threat actor may change, the fundamental principles of defense remain the same. The resurgence of these groups highlights the critical need for proactive, rather than reactive, cybersecurity measures. Organizations are urged to focus on the "attack surface," ensuring that vulnerabilities are patched promptly and that multi-factor authentication (MFA) is implemented across all remote access points.

The NCC Group’s analysis serves as a warning that the "dip" in ransomware activity seen in June was not an indicator of the threat disappearing, but rather a temporary recalibration. The researchers noted that as these groups settle into their new roles, it would not be surprising to see these figures continue to climb throughout the remainder of the year.

For many organizations, the primary defense against this heightened threat environment is the implementation of a robust incident response plan. Because ransomware attacks are now occurring at a faster velocity, the time between initial access and data encryption has shrunk significantly. Consequently, businesses must move toward automated detection and response capabilities that can identify anomalous behavior within the network before the encryption process can be triggered.

As the industry moves into the latter half of the year, the combination of Lockbit’s operational dominance and the re-emergence of Conti’s successors suggests that the ransomware threat is entering a new, more unpredictable chapter. While international law enforcement remains focused on dismantling the leadership structures of these groups, the rapid adaptation of the cybercriminal underground continues to outpace traditional mitigation strategies. For global organizations, the current trend serves as a stark reminder that the digital threat landscape is rarely static, and the risks posed by these criminal enterprises remain a top-tier priority for corporate risk management.