Lockbit Reasserts Dominance as Ransomware Attacks Surge Following Conti Group Restructuring

The global cybersecurity landscape is currently grappling with a sharp resurgence in ransomware activity, as data from the NCC Group’s July 2022 Threat Pulse report reveals a significant 47 percent month-over-month increase in successful digital extortion campaigns. After a period of relative volatility earlier in the year, the threat environment is being reshaped by a combination of established giants and the tactical evolution of splinter groups emerging from the ashes of former syndicates. At the center of this surge is Lockbit, which has cemented its status as the most prolific ransomware-as-a-service (RaaS) operation currently in existence.

The Statistical Reality of the July Surge

According to findings derived from active monitoring of leak sites—the primary method used by criminal syndicates to pressure victims by publishing stolen sensitive data—there were 198 successful ransomware attacks recorded in July. This figure represents a stark contrast to the relative cooling period observed in June. While this total remains below the peak levels observed earlier this year, when March and April saw nearly 300 campaigns each, the upward trajectory is cause for significant concern among cybersecurity professionals and government agencies.

Lockbit, specifically through its latest iteration known as Lockbit 3.0, was responsible for 62 of these incidents. This volume of activity is not only an increase of ten attacks compared to the previous month, but it also places the group in a league of its own. To put the scale of this threat into perspective, Lockbit’s output in July was more than double the combined total of the second and third most prolific actors in the ecosystem. The data suggests that Lockbit has effectively refined its operational model, moving beyond mere nuisance-level attacks to become a systemic threat that organizations of all sizes must proactively defend against.

The Structural Evolution: The Aftermath of Conti

The resurgence of ransomware is not merely a result of increased activity by incumbents like Lockbit; it is intrinsically tied to the tactical reorganization of former affiliates of the Conti group. In May, the U.S. State Department took aggressive action against Conti, which had long been considered the world’s most dangerous ransomware gang. By offering rewards of up to $15 million for information leading to the identification and localization of key Conti leaders and co-conspirators, the U.S. government effectively disrupted the group’s operations.

However, the nature of RaaS syndicates is inherently decentralized. When a major group faces intense law enforcement pressure, its members rarely retire. Instead, they reorganize, rebrand, and redistribute their capabilities. The NCC Group report highlights that Hiveleaks and BlackBasta—the second and third most active groups in July—are deeply rooted in the Conti legacy. Hiveleaks recorded 27 attacks in July, representing a staggering 440 percent increase from June, while BlackBasta accounted for 24 attacks, a 50 percent increase over the same period.

The evidence suggests that these entities are not new players but rather the manifestation of Conti’s structural dissolution. Hiveleaks appears to be operating as a direct affiliate spin-off, while BlackBasta has emerged as a distinct, aggressive strain that utilizes the existing infrastructure and expertise once reserved for Conti’s high-value targets. This transition confirms a long-held fear within the intelligence community: the dismantling of a central command does not eliminate the threat, but rather atomizes it into smaller, potentially more agile and harder-to-track organizations.

Chronology of the 2022 Ransomware Climate

To understand the current state of the threat landscape, it is necessary to examine the timeline of the past seven months:

• Q1 2022 (January–March): Ransomware activity remained at historically high levels, with March reaching a peak of approximately 300 incidents. The conflict in Ukraine initially caused some disruption to Eastern European cybercrime syndicates, but they quickly pivoted back to aggressive monetization.
• April 2022: The volume of attacks remained consistent with March, as groups like Conti and Lockbit utilized sophisticated phishing and vulnerability exploitation techniques to maintain their high revenue streams.
• May 2022: The U.S. government increased the pressure on the Conti group. This period marked the beginning of a decline in large-scale, centralized operations as affiliates began to fear international repercussions.
• June 2022: A notable dip in reported activity occurred. This period is now viewed by researchers as a "reset" phase, during which former Conti affiliates moved into new roles and established new operational identities.
• July 2022: The "resurgence" phase began. As the new groups (Hiveleaks, BlackBasta) stabilized their processes and Lockbit 3.0 refined its recruitment of affiliates, the frequency of successful compromises accelerated to 198 incidents.

Analysis of the RaaS Ecosystem

The Ransomware-as-a-Service model remains the engine driving this instability. By leasing their malware strains to "affiliates" in exchange for a percentage of the ransom payment, core groups like Lockbit minimize their own risk while maximizing the reach of their attacks. Lockbit 3.0, in particular, has introduced features that emulate legitimate software-as-a-service (SaaS) business models, including bug bounty programs for their own malicious code and improved user interfaces for their leak sites.

The implications for global businesses are profound. Because these groups operate with a high degree of specialization, they are no longer restricted to specific industries. They utilize a broad spectrum of "initial access brokers"—criminals who specialize in breaching networks and selling that access to the highest bidder. This creates a supply chain of crime where the person who breaches the network is often not the one who deploys the ransomware.

Broader Impact and Security Implications

The rise of these smaller, Conti-derived groups suggests that the threat landscape is becoming more fragmented, which complicates law enforcement attribution. When a single large group is responsible for a vast majority of attacks, intelligence agencies can focus their resources on identifying a finite set of individuals. When that group splits into dozens of smaller, highly capable offshoots, the number of targets increases, and the agility of the attackers improves.

Industry analysts emphasize that the "new normal" for organizations involves preparing for a perpetual state of threat. The NCC Group’s findings serve as a stark reminder that cyber resilience cannot be a one-time initiative. As Hiveleaks and BlackBasta continue to mature, it is anticipated that their tactics will become more sophisticated, potentially involving more complex double-extortion schemes where data is not only encrypted but also exfiltrated to be used as leverage for public shaming.

Recommendations for Defensive Posture

In response to these findings, cybersecurity experts recommend a shift toward "assume breach" mentalities. Traditional perimeter-based security is increasingly insufficient against groups that leverage stolen credentials and exploit day-zero vulnerabilities. Organizations are urged to:

1. Enhance Multi-Factor Authentication (MFA): Implementing robust, phishing-resistant MFA is the single most effective barrier against initial access brokers.
2. Regular Offline Backups: As ransomware groups focus on destroying backups to increase the pressure to pay, immutable, offline backups remain the last line of defense.
3. Vulnerability Management: The rapid rise of BlackBasta, in particular, has been linked to the exploitation of known software vulnerabilities. Maintaining a strict patching cadence for VPNs, remote desktop protocols, and public-facing servers is critical.
4. Continuous Monitoring: With groups like Lockbit 3.0 constantly iterating, organizations should employ Endpoint Detection and Response (EDR) tools that monitor for behavioral anomalies rather than just known file signatures.

As we move into the final months of the year, the intelligence provided by the NCC Group suggests that we are witnessing the beginning of a new, highly competitive phase in the ransomware economy. With Lockbit leading the charge and the former Conti ecosystem reconstituting itself into leaner, more aggressive units, the pressure on the global digital infrastructure is expected to intensify. The resilience of the private sector in the face of these evolving threats will ultimately determine whether this current surge continues to escalate or if collective defensive efforts can begin to force a decline in the profitability of these criminal enterprises.