Lockbit Dominates Ransomware Landscape as Conti Offshoots Drive Significant Resurgence in Cyberattacks

A notable resurgence in ransomware attacks has been observed this summer, with Lockbit firmly establishing itself as the most prolific threat actor, closely followed by two emergent groups identified as offshoots of the previously dominant Conti ransomware syndicate. This uptick follows a brief period of decline, indicating the adaptive and resilient nature of organized cybercrime. Data released by the NCC Group in its July 2022 Monthly Threat Pulse report underscores this trend, attributing the renewed intensity to the persistent activity of established ransomware-as-a-service (RaaS) groups and the rapid re-establishment of fragmented entities.

Lockbit 3.0: Solidifying its Foothold as the Foremost Threat

According to NCC Group’s meticulous monitoring of ransomware leak sites, which involves scraping victim details as they are publicly released, Lockbit was unequivocally the most active ransomware gang in July. The group was linked to an alarming 62 attacks during the month, marking a significant increase of ten incidents compared to June. This figure is more than double the combined total of the second and third most prolific groups, highlighting Lockbit’s formidable operational capacity and reach. The report’s authors explicitly state, "Lockbit 3.0 maintain their foothold as the most threatening ransomware group, and one with which all organizations should aim to be aware of."

Lockbit operates a highly sophisticated Ransomware-as-a-Service model, a business structure that enables core developers to lease their ransomware infrastructure and tools to affiliate hackers. These affiliates then carry out the attacks, with profits typically split between the developers and the attackers. This model has allowed Lockbit to scale its operations rapidly and maintain a broad network of malicious actors, making it a persistent and adaptable threat. The introduction of Lockbit 3.0, also known as ‘BlackMatter,’ in June 2022, brought with it enhanced capabilities, including new encryption methods and a bug bounty program – a controversial move aimed at improving the exploit kits used in their attacks by incentivizing security researchers to find vulnerabilities in their own systems. This innovative, albeit malicious, approach further cements Lockbit’s position at the forefront of the ransomware landscape, demanding heightened vigilance from organizations across all sectors.

The Return of Conti’s Legacy: Hiveleaks and BlackBasta Emerge

The second and third most active groups in July were identified as Hiveleaks, responsible for 27 attacks, and BlackBasta, with 24 attacks. These statistics represent an astonishing rate of growth for both entities. Hiveleaks saw a staggering 440 percent increase in activity since June, while BlackBasta experienced a 50 percent rise. The NCC Group’s analysis posits a direct link between this resurgence and the strategic restructuring of the notorious Conti ransomware syndicate, suggesting an intimate connection between the overall rise in attacks and the emergence of these two particular groups.

Ransomware’s Volatile Trajectory: A Chronological Perspective

The overall landscape of ransomware attacks has demonstrated significant flux throughout the year. Researchers from NCC Group documented 198 successful ransomware campaigns in July alone, representing a substantial 47 percent increase from June. While this sharp incline signals a troubling trend, it is important to contextualize it against the high-water mark set earlier in the spring, when nearly 300 such campaigns were recorded in both March and April. The subsequent dip in May and June offered a momentary reprieve, which, as current data suggests, was merely a precursor to a renewed offensive.

The reasons behind this volatility are complex and deeply rooted in the geopolitical and strategic responses to cybercrime. A pivotal event occurred in May when the United States government significantly escalated its efforts against Russian cybercrime. The U.S. Department of State offered a reward of up to $15 million for information leading to the identification or location of key leaders and co-conspirators of the Conti ransomware variant, which at the time was the world’s foremost ransomware gang. This unprecedented financial incentive, coupled with intense international pressure and intelligence-sharing initiatives, exerted immense pressure on Conti’s operations.

The NCC Group report speculates on the direct impact of these actions: "It is likely that the threat actors that were undergoing structural changes, and have begun settling into their new modes of operating, resulting in their total compromises increasing in conjunction." This assessment suggests that the dip observed in May and June was not a sign of retreat but rather a period of reorganization and adaptation within the cybercriminal underworld.

The Anatomy of Fragmentation: Conti’s Dissolution and Rebirth

The U.S. government’s intensified efforts, particularly the reward offer, are widely believed to have played a crucial role in the eventual fragmentation of the Conti syndicate. Conti, a highly sophisticated and prolific RaaS group, had previously been responsible for attacks on hundreds of organizations globally, including critical infrastructure entities and government agencies. Its operations were severely disrupted by a combination of internal leaks – including a trove of internal chat logs and source code released by a pro-Ukraine researcher in February 2022 following Conti’s public support for Russia’s invasion of Ukraine – and sustained pressure from international law enforcement.

The group’s eventual ‘disbanding’ in May 2022, as widely reported by cybersecurity firms, was not a true cessation of operations but rather a strategic metamorphosis. Instead of operating under a single, high-profile brand, the various affiliates and core developers of Conti scattered, forming smaller, more agile, and harder-to-track splinter groups. This strategy is a common tactic employed by cybercriminal organizations facing intense scrutiny; by diversifying their operations, they aim to dilute the focus of law enforcement and intelligence agencies.

Hiveleaks and BlackBasta are identified by the NCC Group as direct descendants of this fragmentation. The report explicitly notes that both groups are "associated with Conti," with Hiveleaks operating as an affiliate and BlackBasta emerging as a replacement strain. This confirms that Conti’s formidable presence has not vanished but has merely "filtered back into the threat landscape, albeit under a new identity." This strategic rebranding and restructuring allow the same underlying expertise, infrastructure, and malicious intent to persist, merely under different banners.

Broader Context: The Global Ransomware Landscape and Economic Impact

The resurgence in ransomware activity, spearheaded by Lockbit and the Conti offshoots, is indicative of a broader and deeply entrenched global cybercrime ecosystem. Ransomware has evolved from opportunistic attacks to a highly organized, professionalized, and lucrative industry. Reports from various cybersecurity firms, such as Chainalysis and Palo Alto Networks, consistently highlight the billions of dollars lost annually to ransomware attacks, impacting businesses, government entities, and critical infrastructure worldwide. The average ransom payment has also steadily increased, putting immense financial strain on victim organizations.

The RaaS model, perfected by groups like Lockbit and Conti, lowers the barrier to entry for aspiring cybercriminals, providing them with sophisticated tools and support without requiring advanced technical expertise. This decentralized model makes attribution and disruption significantly more challenging for law enforcement, as taking down one affiliate does not dismantle the entire operation. Furthermore, the use of cryptocurrencies for ransom payments provides a degree of anonymity, complicating financial tracing efforts.

Government and Industry Responses: A Multi-pronged Approach

In response to the escalating threat, governments worldwide, including the United States and its allies, have adopted a multi-pronged approach to combat ransomware. Beyond offering rewards for information, strategies include:

• International Cooperation: Enhanced collaboration between law enforcement agencies (e.g., FBI, Europol, INTERPOL) to share intelligence, coordinate operations, and conduct joint investigations across borders.
• Sanctions: Imposing sanctions on individuals and entities involved in ransomware operations, targeting their financial networks and restricting their ability to operate internationally.
• Disruptive Operations: Proactive measures to disrupt ransomware infrastructure, including taking down command-and-control servers, seizing cryptocurrency wallets, and arresting key operators.
• Public-Private Partnerships: Fostering collaboration between government agencies and private sector cybersecurity firms to share threat intelligence, develop defensive strategies, and provide support to victim organizations.
• Capacity Building: Investing in cybersecurity education, training, and infrastructure to enhance national resilience against cyberattacks.

While these efforts have achieved some successes, such as the disruption of Colonial Pipeline attackers and the pressure on Conti, the current data suggests that cybercriminal groups are highly adaptive. They learn from disruptions, evolve their tactics, and restructure their operations to evade detection and maintain profitability. The US government’s sustained focus on identifying and penalizing actors in the ransomware ecosystem, while vital, appears to catalyze a continuous game of cat and mouse rather than an outright elimination of the threat.

Implications for Organizations: Navigating the Evolving Threat Landscape

The resurgence of ransomware, particularly the dominance of Lockbit and the re-emergence of Conti’s offshoots, carries significant implications for organizations globally. It underscores the persistent and evolving nature of cyber threats and the critical need for robust, proactive cybersecurity measures.

• Enhanced Vigilance: Organizations must remain acutely aware of the latest threat intelligence, understanding the tactics, techniques, and procedures (TTPs) employed by active groups like Lockbit, Hiveleaks, and BlackBasta.
• Proactive Defenses: Investing in layered security solutions, including advanced endpoint detection and response (EDR), network segmentation, multi-factor authentication (MFA), and robust email security, is paramount. Regular vulnerability assessments and penetration testing are also crucial to identify and remediate weaknesses before attackers can exploit them.
• Incident Response Planning: Developing and regularly testing comprehensive incident response plans is essential. This includes clear communication protocols, data recovery strategies (with immutable backups), and established relationships with cybersecurity incident response firms.
• Employee Training: Human error remains a significant vector for ransomware attacks. Ongoing security awareness training for all employees, focusing on phishing recognition, safe browsing habits, and reporting suspicious activity, is vital.
• Supply Chain Security: The interconnectedness of modern business means that an attack on a third-party vendor can compromise an organization’s own systems. Robust vendor risk management and supply chain security protocols are increasingly important.

The NCC Group’s concluding speculation that "it would not be surprising to see these figures further increase as we move into August" serves as a stark warning. The fragmentation of major groups like Conti, rather than eradicating the threat, has diversified it, creating a more complex and fragmented threat landscape. Organizations must anticipate sustained and evolving ransomware campaigns, requiring continuous adaptation and investment in cybersecurity resilience to safeguard their operations and data against these formidable and persistent adversaries. The current trends indicate that the fight against ransomware is far from over; it has merely entered a new, more decentralized, and potentially more challenging phase.