Ransomware Resurgence Led by Lockbit and Evolving Conti Offshoots Marks a Volatile Summer for Global Cybersecurity
The global digital landscape is facing a renewed period of instability as ransomware activity surges, according to the latest intelligence data from the NCC Group. Following a brief period of apparent dormancy during the late spring, the frequency of successful ransomware attacks has spiked significantly, with July figures indicating a 47 percent increase in activity compared to the preceding month. This resurgence is not merely a quantitative shift but a structural one, characterized by the dominance of the Lockbit ransomware-as-a-service (RaaS) operation and the tactical metamorphosis of the dismantled Conti syndicate into new, aggressive offshoots.
The latest NCC Group Monthly Threat Pulse report reveals that researchers documented 198 successful ransomware campaigns throughout July. While this represents a notable rebound from June, it remains lower than the peak levels observed in March and April, when global campaigns approached 300 per month. However, the current trajectory suggests that the threat environment is recalibrating, as criminal actors move past the operational disruptions that characterized the early summer months.
The Unrivaled Dominance of Lockbit 3.0
At the center of this landscape is Lockbit, which has cemented its status as the most prolific ransomware group currently in operation. By actively monitoring the leak sites where these criminal organizations publish stolen data to extort their victims, analysts have identified that Lockbit was responsible for 62 confirmed attacks in July. This figure is not only a 20 percent increase over the group’s performance in June but also positions Lockbit as a force that significantly outpaces its nearest competitors.
The group’s latest iteration, known as Lockbit 3.0, has introduced new features that have made it increasingly difficult for organizations to defend against. By employing sophisticated evasion techniques and aggressively recruiting affiliates through a RaaS model, Lockbit has managed to maintain a consistent foothold in various industry sectors. The NCC Group report explicitly warns that the group has become a persistent threat that requires immediate attention from organizational security leaders, given its capacity for high-frequency deployment.
The Structural Evolution of the Conti Syndicate
The resurgence of ransomware is deeply tied to the disintegration of the Conti group, which was once considered the most dangerous ransomware syndicate in existence. In early 2022, Conti faced significant internal challenges, including the leakage of internal communications and source code, which weakened its operational security. However, the final blow to its traditional structure came in May, when the United States Department of State announced a reward of up to $15 million for information leading to the identification or location of key leadership figures within the Conti operation.
This move by U.S. authorities, intended to dismantle the group’s hierarchy, did not result in the permanent cessation of the threat. Instead, it triggered a strategic restructuring. Data suggests that the operational capacity of the Conti group has simply migrated to new entities. Hiveleaks and BlackBasta, the second and third most active groups in July, are now widely considered to be the direct products of this evolution.
Hiveleaks accounted for 27 attacks in July, a staggering 440 percent increase from its June activity. Similarly, BlackBasta recorded 24 attacks, a 50 percent increase over the same period. Researchers have characterized Hiveleaks as a functional affiliate of the remnants of the Conti network, while BlackBasta appears to be a new strain developed by former Conti operators to bypass the scrutiny and legal pressure applied to the original brand. This shift highlights the "hydra" effect inherent in modern cybercrime, where pressure on one criminal node results in the rapid proliferation of others.
A Chronology of the 2022 Ransomware Climate
The current state of the threat landscape can be viewed as a direct response to geopolitical and law enforcement pressures. The first quarter of 2022 was defined by high-intensity campaigns, with March and April seeing record-breaking levels of extortion. During this time, groups like Conti were operating with impunity, leveraging their established infrastructure to hit critical infrastructure and large enterprises.
By May, the impact of international sanctions and the U.S. State Department’s bounty offer began to take hold. This period was marked by a temporary "flux" in the data, where the number of successful attacks appeared to decline as threat actors paused to reorganize, rebrand, and secure new operational bases. By late June, these groups had largely stabilized their new, smaller, and more agile organizations. July served as the month where this new architecture was fully deployed, leading to the sharp 47 percent increase in successful breaches that now characterizes the late summer landscape.
Analysis of Implications for Global Infrastructure
The implications of this shift are profound for both the private and public sectors. The decentralization of the Conti syndicate into entities like BlackBasta and Hiveleaks makes it significantly more difficult for law enforcement agencies to track and dismantle the underlying criminal infrastructure. While the U.S. government’s strategy of targeting leadership was effective in breaking the Conti monolith, it has inadvertently fostered a more diverse and unpredictable ecosystem of smaller, highly capable ransomware groups.
Furthermore, the reliance on the RaaS model—where developers of the ransomware software lease their product to affiliates—continues to democratize access to advanced cyber-attack tools. Lockbit’s dominance in this area is particularly concerning, as the group provides a high-quality, reliable, and easily accessible platform for threat actors who might otherwise lack the technical sophistication to execute complex intrusions.
Data-Driven Risk Management
For organizations, the current data underscores the necessity of moving beyond traditional signature-based detection. The NCC Group report suggests that because these groups are in a constant state of flux, security strategies must be focused on behavioral analysis and proactive threat hunting.
"Lockbit 3.0 maintains their foothold as the most threatening ransomware group, and one with which all organizations should aim to be aware of," the researchers noted. This awareness requires organizations to map their defenses against the specific tactics, techniques, and procedures (TTPs) utilized by these groups, which often involve lateral movement and double-extortion strategies, where data is both encrypted and stolen to ensure payment.
Looking Ahead: The Forecast for Late 2022
The volatility of the current market suggests that the upward trend in ransomware activity will likely continue into the autumn. With the Conti remnants now settled into their new operating modes and Lockbit showing no signs of slowing its aggressive recruitment and deployment tactics, the threat level remains critical.
Cybersecurity analysts emphasize that as these groups compete for affiliates and targets, they are likely to increase the frequency of their attacks to assert dominance in the criminal underworld. Organizations should prepare for a period of sustained pressure, characterized by an influx of new strains and the continued repurposing of existing malware code.
The resilience of these criminal networks, despite significant international law enforcement efforts, highlights the systemic nature of the ransomware challenge. As the digital economy grows more interconnected, the ability of these groups to find and exploit vulnerabilities remains a constant risk. The events of this summer serve as a stark reminder that in the realm of cybercrime, disruption is rarely synonymous with total elimination. Instead, the focus for the remainder of the year must remain on defense-in-depth strategies, robust data backup protocols, and an intelligence-led approach to incident response. By understanding the shifting nature of these groups, organizations can better position themselves to withstand the waves of attacks that have become a defining feature of the modern digital era.
