Lockbit Reigns Supreme as Ransomware Ecosystem Rebounds Following the Fragmentation of Conti

The global threat landscape for cybersecurity underwent a significant transformation throughout the summer of 2022, characterized by a marked resurgence in ransomware-as-a-service (RaaS) operations. According to the latest monthly threat intelligence report from the NCC Group, the industry has observed a 47 percent surge in successful ransomware attacks during July, signaling a recovery for threat actors following a period of relative volatility. At the center of this uptick is Lockbit, which has solidified its position as the most prolific ransomware group in existence, while the remnants of the once-dominant Conti cartel have begun to resurface under new, decentralized operational banners.

The July Resurgence: A Quantitative Analysis

In July 2022, researchers at NCC Group identified 198 distinct ransomware campaigns, a significant climb from the 135 incidents recorded in June. This rebound suggests that the disruption observed earlier in the spring—largely attributed to shifting geopolitical pressures and internal organizational restructuring within major gangs—was a transient phenomenon rather than a permanent decline in cybercriminal activity.

The primary driver of this activity is Lockbit 3.0. By systematically scraping data from leak sites and monitoring victim notifications, analysts determined that Lockbit was responsible for 62 attacks in July alone. This figure represents a 19 percent increase over their performance in June and places the group in a category of its own. To put this volume into perspective, Lockbit’s monthly output is more than double the combined total of the second and third most active groups, Hiveleaks and BlackBasta. The group’s transition to the "3.0" iteration has been marked by more aggressive extortion tactics and a refined operational infrastructure, making it a critical focus for global security operations centers (SOCs) and threat hunters.

The Shadow of Conti: A Chronology of Fragmentation

To understand the current threat landscape, one must look back to the first half of 2022, a period defined by the unprecedented decline of the Conti ransomware group. At the start of the year, Conti was widely considered the most dangerous threat to enterprise security, operating with a sophisticated hierarchy and significant financial resources.

However, the group’s trajectory shifted dramatically following the Russian invasion of Ukraine. In February 2022, after Conti publicly declared support for the Russian government, a pro-Ukrainian security researcher leaked internal chat logs, source code, and operational details belonging to the group. This "ContiLeaks" event severely damaged the gang’s reputation and internal security. The situation deteriorated further in May, when the United States Department of State announced a reward of up to $15 million for information leading to the identification and localization of key Conti leaders.

Facing intense international scrutiny and the threat of law enforcement intervention, the core members of Conti opted for a strategy of "controlled dissolution." Rather than abandoning their criminal enterprises, the leadership dispersed into smaller, more agile units. This restructuring has directly birthed the current surge in activity from groups like Hiveleaks and BlackBasta. Hiveleaks, which saw a 440 percent increase in activity between June and July, and BlackBasta, which experienced a 50 percent growth in the same period, are now recognized as the ideological and operational successors to the fragmented Conti infrastructure.

Implications for Corporate Defense

The evolution of these groups from a single, centralized entity into a constellation of smaller, high-velocity organizations presents a new challenge for cybersecurity professionals. Historically, security teams could focus their defensive strategies on the known tactics, techniques, and procedures (TTPs) of a few dominant players. Today, the decentralization of the Conti core means that defenses must be adapted to a wider variety of operational signatures.

The rise of Hiveleaks and BlackBasta indicates that the expertise, initial access brokers, and malicious tools previously developed under the Conti umbrella have not vanished; they have been redistributed. This democratization of high-level ransomware tools is likely to keep the volume of attacks elevated throughout the latter half of the year. Furthermore, the reliance on the RaaS model—whereby core developers provide the software to various affiliates who execute the attacks—allows these groups to maintain a high level of operational security while simultaneously scaling their impact across diverse industry verticals.

Sector-Specific Vulnerabilities and Economic Impact

The July NCC Group data underscores that no industry is immune to the current wave of attacks. While the manufacturing and professional services sectors remain the most frequent targets, the healthcare and education sectors have also seen a steady stream of incidents. The economic cost of these attacks is not limited to the ransom demands themselves. When factoring in the cost of forensic investigations, legal counsel, regulatory fines, and the inevitable business interruption, the financial burden placed on victimized organizations is substantial.

In July, the shift in tactics was particularly visible in the way data was exfiltrated. Ransomware groups have moved toward a "double extortion" model, where the encryption of data is merely the first stage. The threat of publishing sensitive or proprietary data on public leak sites—a tactic pioneered by earlier iterations of Conti and now perfected by Lockbit—has become the primary lever for forcing payment. This shift necessitates that organizations prioritize data loss prevention (DLP) and immutable backups as fundamental pillars of their defense, rather than relying solely on endpoint detection and response (EDR) solutions.

The Future of the Threat Landscape

While the 198 attacks reported in July represent a sharp increase, it is important to contextualize this figure against the historical highs of March and April 2022, when nearly 300 campaigns were identified each month. The current climate is one of transition, where threat actors are "settling in" to their new organizational models.

Security analysts anticipate that the "Conti split" will continue to influence the threat landscape for the remainder of the year. As these splinter groups refine their own RaaS programs and recruit new affiliates, the number of monthly campaigns may continue to climb toward the levels seen in early spring. The competitive nature of these groups—Lockbit, Hiveleaks, and BlackBasta competing for affiliates and victims—could lead to a "race to the bottom" regarding victim safety, where groups may adopt even more desperate or destructive tactics to differentiate themselves.

For organizations, the message from the latest threat intelligence is clear: the threat of ransomware is not a waning concern, but a persistent and evolving reality. The fragmentation of large syndicates does not equate to a weakening of the threat; rather, it indicates a broadening of the attack surface.

Strategic Recommendations for Risk Mitigation

In response to these findings, cybersecurity leaders are advised to move beyond basic perimeter defense. The current threat environment requires:

1. Enhanced Threat Intelligence Integration: Organizations should actively monitor threat intelligence feeds that provide specific indicators of compromise (IoCs) associated with Lockbit 3.0 and the newer Conti-affiliated strains.
2. Zero Trust Architecture: By implementing a Zero Trust model, enterprises can limit the lateral movement of threat actors even if an initial breach occurs. This is critical when dealing with groups that specialize in rapid network infiltration.
3. Incident Response Preparedness: Given the speed at which these groups operate, having a pre-vetted, actionable incident response plan is mandatory. Regular tabletop exercises that simulate a ransomware scenario can significantly reduce the time to detection and containment.
4. Supply Chain Due Diligence: Many of the recent attacks have utilized third-party service providers as a gateway into larger organizations. Auditing the security posture of partners and vendors is an essential, if often overlooked, component of a comprehensive risk management strategy.

As we move deeper into the third and fourth quarters, the resilience of the ransomware ecosystem serves as a reminder of the profitability of cybercrime. The transition of Conti into multiple, smaller, and arguably more agile operations has created a more complex threat environment. While governments continue to place bounties on the heads of cybercriminals and attempt to disrupt infrastructure, the decentralized nature of these gangs ensures that the ransomware problem will remain a defining challenge for global industry leaders for the foreseeable future. Understanding the patterns of these groups, their lineage, and their evolving tactics remains the best path toward sustaining a robust and proactive security posture.