The global cybersecurity landscape is witnessing a volatile transformation as ransomware activity experiences a significant resurgence, driven primarily by the dominance of the Lockbit collective and the strategic restructuring of former Conti affiliates. According to the latest monthly Threat Pulse report from the NCC Group, July 2022 marked a pivotal shift in the trajectory of digital extortion, with successful ransomware campaigns climbing to 198—a 47 percent increase compared to the previous month. While this uptick signals a departure from the slight decline observed in early summer, researchers emphasize that the threat environment is evolving into a more decentralized and aggressive ecosystem.
The core of this resurgence lies in the persistent dominance of Lockbit, specifically the Lockbit 3.0 iteration. By systematically monitoring leak sites where criminal groups publish the data of non-compliant victims, cybersecurity analysts have verified that Lockbit was responsible for 62 confirmed attacks in July alone. This figure represents a notable acceleration, marking an increase of ten attacks over June and solidifying the group’s position as the most prolific threat actor in the current market. To put the scale of their operations into perspective, Lockbit’s output in July was more than double the combined total of the second and third most active groups, establishing the gang as a formidable force that necessitates heightened vigilance across all enterprise sectors.
The Evolution of the Ransomware-as-a-Service (RaaS) Model
The current surge in attacks is not merely a quantitative increase but a qualitative shift in how these criminal enterprises are organized. For years, the ransomware-as-a-service (RaaS) model has allowed developers to focus on the technical refinement of malware, while "affiliates" handle the operational side of breaching networks and negotiating ransoms. This division of labor has lowered the barrier to entry for cybercriminals, creating a robust, albeit illicit, economy.
Lockbit’s success is attributed to its highly professionalized affiliate program, which offers high payouts, user-friendly management portals, and consistent updates to its encryption protocols. By constantly iterating on its software—moving from the original Lockbit to 2.0 and now the 3.0 version—the group has managed to outpace many defensive security measures. The shift to 3.0, in particular, introduced a public bug bounty program, an unprecedented move in the cybercriminal underworld that mimics legitimate corporate software development cycles. This strategic maturity suggests that groups like Lockbit are not merely fly-by-night operations but are functioning with the operational discipline of a tech firm.
The Disintegration of Conti and the Rise of Successor Groups
While Lockbit remains the statistical leader, the broader threat landscape is heavily influenced by the dissolution of the Conti group. Throughout 2021 and early 2022, Conti was widely regarded as the most dangerous ransomware gang in existence. However, their prominence triggered a massive, coordinated response from international law enforcement agencies and intelligence services.
In May 2022, the United States Department of State took the rare step of offering a reward of up to $15 million for information leading to the identification or location of key members of the Conti ransomware leadership. This aggressive push, combined with internal fractures within the group caused by leaked communications and geopolitical tensions, forced Conti to pivot. Rather than disappearing entirely, the collective underwent a structural metamorphosis, fragmenting into smaller, more agile units to evade international scrutiny.
The data from the NCC Group identifies the primary beneficiaries of this splintering: Hiveleaks and BlackBasta. In July, Hiveleaks recorded 27 attacks, a staggering 440 percent increase from the previous month. Similarly, BlackBasta reported 24 attacks, representing a 50 percent increase in its operational volume. Researchers have established that both groups are fundamentally associated with the former Conti operation—Hiveleaks functioning as a direct affiliate and BlackBasta serving as a successor strain using similar source code and tactics. This migration of talent and resources demonstrates the resilience of these criminal networks; even as major groups are dismantled or targeted, the human capital and technical expertise simply reorganize under new monikers.
Chronology of the 2022 Ransomware Flux
The fluctuations in ransomware activity throughout 2022 reveal a direct correlation between geopolitical pressure and criminal behavior.
- Q1 2022: Ransomware activity remained high, peaking in March and April with nearly 300 successful campaigns per month. This period was characterized by the dominance of large, centralized syndicates like Conti.
- May 2022: The U.S. government increased its bounty for Conti leadership to $15 million. Simultaneously, intelligence sharing between international law enforcement agencies intensified.
- June 2022: A notable dip in reported ransomware attacks occurred, as threat actors appeared to be in a transition phase, restructuring their operations and rebranding their infrastructure to avoid detection.
- July 2022: The resurgence began. With new operational identities in place—most notably BlackBasta and the expanded footprint of Hiveleaks—activity climbed back to 198 incidents.
This timeline suggests that the "dip" observed in June was a period of consolidation. The criminal actors were not defeated; they were adapting. By splitting into smaller, less recognizable entities, these groups are better able to distribute their risk and maintain their operations beneath the threshold that would typically trigger high-level international sanctions.
Analysis of Operational Implications
The implications of this shift are profound for the cybersecurity community. For incident response teams and CISOs (Chief Information Security Officers), the fragmentation of large groups into numerous smaller, active gangs creates a "noise" problem. Defending against a single, identifiable group allows for specific threat intelligence gathering and targeted defensive posture. When that group splits into a dozen smaller entities, the intelligence becomes diluted, and the attack surface becomes more varied.
Furthermore, the rise of Lockbit 3.0 and the resurgence of Conti-associated groups indicate that the ransomware industry has moved toward a "post-sanction" era. These groups are now prioritizing operational security (OPSEC) and are highly sensitive to the political climate. They have learned that being the "world’s most dangerous" group is a liability. Consequently, we are seeing a shift toward more frequent, smaller-scale attacks rather than a few massive, headline-grabbing incidents. This strategy allows them to fly under the radar of major intelligence agencies while still maintaining a lucrative bottom line.
Preparing for Future Threats
As the market continues to evolve, security professionals must pivot from static defense to active threat hunting. The ability of groups like Hiveleaks and BlackBasta to rapidly scale their operations suggests that the current upward trend in the number of attacks is likely to continue through the remainder of the year.
Organizations are urged to focus on fundamental hygiene: immutable backups, multi-factor authentication, and robust network segmentation. Given that many of these groups utilize initial access brokers—third-party criminals who sell entry into corporate networks—defenders must also focus on securing the perimeter against credential stuffing and phishing, the primary vectors through which these RaaS groups gain their initial foothold.
The resilience of these groups suggests that the "ransomware problem" is not one that will be solved by law enforcement action alone. While the bounty programs and international raids are effective at disrupting specific nodes of the criminal network, the underlying economic incentives of the RaaS model remain intact. As long as there is a market for stolen data and a willingness among some organizations to pay to prevent its release, the ransomware threat will remain a persistent, shape-shifting presence in the global digital economy. The industry should prepare for a volatile autumn, where the competition for victims among these newly reorganized groups may lead to an even higher volume of incursions.
Related posts:
