Ransomware resurgence surges as Lockbit and Conti offshoots dominate the global cyber threat landscape

The digital threat landscape is undergoing a significant transformation, marked by a sharp resurgence in ransomware activity that has effectively ended a brief period of downward trends observed in early summer. According to the latest monthly intelligence report from the NCC Group, global ransomware attacks surged by 47 percent in July, reaching a total of 198 identified campaigns. While this figure remains below the peak levels of nearly 300 monthly attacks recorded in March and April, the sudden uptick underscores the resilience and adaptive nature of cybercriminal syndicates, specifically those operating under the Ransomware-as-a-Service (RaaS) model.

At the center of this renewed wave of hostility is Lockbit 3.0, a group that has cemented its position as the most prolific threat actor in the current ecosystem. By actively scraping victim leak sites and monitoring the infrastructure of various gangs, researchers identified that Lockbit was responsible for 62 successful attacks in July alone. This performance represents a quantitative leap of ten attacks over the previous month and establishes a dominance that dwarfs its competitors; Lockbit is currently executing more than twice as many attacks as the second and third most prolific groups combined.

The Fragmentation of the Conti Empire

The recent volatility in the cybercrime market is inextricably linked to the collapse and subsequent restructuring of the Conti ransomware group. Once the undisputed hegemon of the ransomware world, Conti faced intense pressure in early 2022. The group’s operations were severely disrupted following the internal leak of its private communications—a fallout from its public support of the Russian invasion of Ukraine—and subsequent aggressive law enforcement interventions.

In May 2022, the United States Department of State announced a reward of up to $15 million for information leading to the identification or location of key leadership figures within the Conti organization. This unprecedented financial pressure, combined with international sanctions, forced the group to abandon its monolithic structure. Rather than disappearing, the operators behind Conti opted for a strategy of decentralization.

The rise of Hiveleaks and BlackBasta, which occupied the second and third spots in July’s threat rankings with 27 and 24 attacks respectively, serves as a direct case study in this evolution. Hiveleaks, which saw a staggering 440 percent increase in activity since June, is now widely considered an affiliate of the former Conti infrastructure. BlackBasta, which recorded a 50 percent increase in the same period, is increasingly viewed by security analysts as a successor strain, inheriting the technical sophistication and target acquisition methods of the original Conti codebase.

Chronology of the 2022 Ransomware Flux

To understand the current state of cyber security, it is necessary to examine the trajectory of these organizations over the past eight months:

• January – February 2022: Conti maintains peak dominance, controlling a vast network of affiliates and utilizing high-profile attacks against critical infrastructure and multinational corporations.
• March – April 2022: Ransomware activity hits a 2022 high-water mark, with nearly 300 attacks per month. The ecosystem is characterized by centralized command-and-control structures.
• May 2022: The U.S. State Department issues multi-million dollar bounties for Conti leadership. Internal leaks expose the group’s inner workings and organizational weaknesses.
• June 2022: A temporary decline in reported attacks occurs. This period is now understood as a "structural reset" phase, where former Conti members transitioned into new, smaller, and more agile cells to evade law enforcement scrutiny.
• July 2022: The resurgence begins. Lockbit 3.0 scales its operations to fill the void, while the Conti successor groups, Hiveleaks and BlackBasta, begin their aggressive upward climb.

The Mechanics of RaaS and Market Dynamics

The Ransomware-as-a-Service model functions similarly to legitimate software-as-a-service businesses, albeit with malicious intent. Core developers (the RaaS group) create the encryption software and manage the payment portals, while affiliates are responsible for infiltrating networks, exfiltrating data, and deploying the ransomware.

The current dominance of Lockbit 3.0 is attributed to its highly efficient affiliate program, which offers high payouts and a robust technical platform. By continuously iterating on their software—moving from version 2.0 to 3.0—Lockbit has managed to keep its decryption tools and infection vectors ahead of traditional signature-based antivirus detections.

Analysts at the NCC Group note that the current surge is not merely a matter of increased volume, but an evolution in tactical behavior. As these groups settle into their new operational modes, they are becoming more selective and more efficient. The transition from a single, massive entity like Conti to a fractured landscape of smaller, highly competitive groups has resulted in a "crowding" of the threat landscape. Because each group is now competing for market share, they are incentivized to conduct more frequent attacks to prove their viability to potential affiliates.

Broader Implications for Global Security

The implications of this shift are profound for both the private and public sectors. For organizations, the primary risk is that the "new" versions of Conti (Hiveleaks and BlackBasta) possess the same institutional knowledge and advanced technical capabilities as the original group but operate with less organizational baggage.

Furthermore, the shift in leadership and branding makes tracking and attribution increasingly difficult for global law enforcement. When a group rebrands, its old indicators of compromise (IoCs) become obsolete, forcing security teams to restart the process of building defensive profiles.

Security professionals should note the following strategic imperatives for the current environment:

1. Defense-in-Depth: Given the frequency of Lockbit attacks, reliance on perimeter security is insufficient. Organizations must implement robust endpoint detection and response (EDR) solutions that can identify the anomalous behavior characteristic of RaaS affiliates.
2. Threat Intelligence Integration: Monitoring the dark web and leak sites—as researchers do—is now a standard requirement for large enterprises. Understanding the specific tactics, techniques, and procedures (TTPs) of groups like BlackBasta can allow for proactive hunting of threats before full-scale encryption occurs.
3. Governance and Compliance: The U.S. government’s involvement, including the use of bounty programs, signals that ransomware is no longer just a cybersecurity issue but a national security priority. Compliance frameworks are increasingly being updated to include specific requirements for ransomware incident response.

Outlook for the Remainder of the Year

As the industry moves into the latter half of the year, the outlook remains cautious. The authors of the recent threat pulse report suggest that it would be highly unusual if the current momentum does not continue into August and beyond. As the Conti successors refine their operational procedures and Lockbit continues to aggressively expand its affiliate network, the frequency of successful campaigns is likely to see further growth.

The current landscape represents a maturation of the ransomware industry. Despite international efforts to dismantle these groups, the economic incentives of the RaaS model remain too lucrative to deter participants entirely. The transition from large, centralized criminal organizations to smaller, more fragmented groups has created a more resilient threat model, one that is harder to track, harder to sanction, and harder to neutralize.

For organizations, the primary takeaway is that the "lull" in activity earlier this summer was a temporary realignment rather than a retreat. The resurgence of these groups, driven by the structural changes within the cyber-underworld, means that the baseline for threat preparedness must be raised. Awareness of the specific actors—Lockbit, Hiveleaks, and BlackBasta—and the patterns of their resurgence is no longer optional; it is an essential component of modern enterprise risk management. The resilience of these syndicates ensures that the ransomware crisis will remain a defining feature of the global digital economy for the foreseeable future.