Lockbit Leads Global Ransomware Resurgence as Conti Offshoots Regroup and Expand Operations

The global cybersecurity landscape is currently grappling with a significant uptick in ransomware activity, a trend that marks a reversal of the temporary decline observed in the early summer months. According to the latest monthly threat pulse report from the NCC Group, a total of 198 successful ransomware campaigns were identified in July 2022. This represents a stark 47 percent increase compared to the previous month, signaling that the criminal syndicates behind these attacks have successfully navigated recent geopolitical pressures and law enforcement interventions to resume their offensive operations.

At the center of this surge is the Lockbit ransomware-as-a-service (RaaS) group, specifically the iteration known as Lockbit 3.0. By systematically monitoring and scraping data from the leak sites where these groups publish stolen information, security researchers have determined that Lockbit was responsible for 62 confirmed attacks in July alone. This figure not only represents an increase of ten attacks over June but also confirms Lockbit’s position as the dominant threat actor, accounting for more than twice the volume of attacks generated by its two closest competitors combined.

The Changing Landscape of Ransomware Gangs

While Lockbit 3.0 maintains a firm hold on the top spot, the remainder of the top three reflects a profound shift in the organizational structure of major cybercriminal entities. The second and third most active groups in July were Hiveleaks, which recorded 27 attacks, and BlackBasta, which was responsible for 24.

The growth trajectory for these two groups is particularly alarming to security analysts. Hiveleaks saw a staggering 440 percent increase in activity between June and July, while BlackBasta’s operations grew by 50 percent in the same period. These figures suggest that the ransomware ecosystem is not merely experiencing a return to form, but is undergoing a structural evolution that favors agile, rebranded, or newly formed entities over legacy powerhouses.

Chronology of a Shift: The Aftermath of the Conti Disruption

To understand the current surge, it is necessary to examine the events of the spring and early summer of 2022. During the first quarter of the year, ransomware activity was reaching its peak, with nearly 300 successful campaigns recorded in both March and April. However, this momentum hit a wall in May following a series of decisive actions taken by the United States government and its international partners.

In May 2022, the U.S. State Department took the unprecedented step of offering rewards of up to $15 million for information leading to the identification or location of the key leadership figures of the Conti ransomware group. At the time, Conti was widely considered the most dangerous and prolific ransomware syndicate globally, operating with a level of sophistication that mimicked legitimate corporate structures.

The pressure exerted by this bounty, combined with internal fractures within the group and increased scrutiny from intelligence agencies, forced the dissolution of the Conti brand. However, the data from July suggests that this was not the end of the threat posed by the group’s personnel, but rather a strategic dispersal. The NCC Group report identifies both Hiveleaks and BlackBasta as entities with deep ties to the former Conti infrastructure. Hiveleaks appears to be operating as an affiliate of the defunct group, while BlackBasta has emerged as a direct replacement strain, utilizing much of the underlying code and tactical methodology that made Conti successful.

Data Analysis: The Volatility of the Threat Pulse

The fluctuation in attack numbers—from the high of 300 in April to the post-law enforcement dip and the subsequent climb in July—highlights the resilience of the RaaS model. Ransomware-as-a-service allows core developers to lease their malicious software to "affiliates," who then conduct the actual breaches. This decentralized approach creates a high degree of redundancy; when a central brand like Conti comes under fire, the affiliates simply migrate their operations to other platforms, such as Lockbit or emerging groups like BlackBasta.

Security researchers emphasize that the current surge is likely the result of these displaced actors settling into new operational roles. The process of transitioning from one brand to another requires time for recruitment, infrastructure setup, and target reconnaissance. With these organizational changes now largely complete, the industry is seeing a renewed acceleration in compromise rates. The 198 attacks recorded in July, while still below the record-breaking numbers of March and April, demonstrate that the ransomware economy remains robust and highly capable of adaptation.

Implications for Global Cybersecurity

The implications of this resurgence for organizations and critical infrastructure providers are significant. The primary takeaway from the current intelligence is that relying on the hope that government intervention will permanently disable a threat group is a flawed strategy. Instead, the focus must remain on hardened defensive postures and proactive threat hunting.

The dominance of Lockbit 3.0, in particular, warrants heightened vigilance. As a mature platform, Lockbit 3.0 has integrated features that make it particularly effective at bypassing standard endpoint detection and response (EDR) solutions. By offering a "bug bounty" program for their own malicious software and continuously updating their encryption protocols, they have created a product that is highly attractive to low-level cybercriminals looking for an easy route to illicit revenue.

Furthermore, the rise of Conti-linked offshoots indicates that the threat actors are becoming more geographically and operationally distributed. This makes it increasingly difficult for international law enforcement to pinpoint a single point of failure or to execute a "silver bullet" takedown strategy. Organizations must assume that the threat landscape will remain fluid, with groups rapidly changing names, tactics, and infrastructure to stay one step ahead of the defensive community.

Strategic Recommendations and Future Outlook

As the industry moves into the latter half of the year, security analysts anticipate that the volume of attacks could continue to rise. If the current trajectory of Hiveleaks and BlackBasta continues, we may see a further erosion of the market share currently held by smaller groups, leading to a more consolidated, and therefore more dangerous, threat environment.

For organizations, the recommendations remain consistent but urgent:

1. Patch Management: Prioritizing the patching of known vulnerabilities, as these remain the primary entry points for both Lockbit and Conti-derived variants.
2. Multi-Factor Authentication (MFA): Ensuring that MFA is implemented across all remote access points, which serves as a major deterrent against initial unauthorized access.
3. Data Backups: Maintaining offline, immutable backups that are verified regularly. This remains the only reliable safeguard against the impact of a successful encryption event.
4. Monitoring: Actively monitoring dark web leak sites and threat intelligence feeds. As the NCC Group report demonstrates, these sites provide a "canary in the coal mine" for emerging trends in the ransomware ecosystem.

The current situation serves as a stark reminder that the cybercrime ecosystem is inherently adaptive. While the dismantling of the Conti brand was a tactical victory for international authorities, it also triggered a process of evolution that has resulted in a more diverse and persistent threat landscape. As Lockbit continues to expand its reach and former Conti affiliates refine their new brands, the pressure on private and public sector organizations to strengthen their digital defenses has never been greater. The coming months will likely be defined by a persistent battle between these sophisticated criminal syndicates and the security teams tasked with maintaining the integrity of global networks.