Lockbit Reclaims Dominance as Ransomware Activity Surges Following the Fragmentation of the Conti Syndicate

The global cybersecurity landscape is currently witnessing a pronounced resurgence in ransomware-as-a-service (RaaS) operations, marked by a 47 percent increase in successful campaigns throughout July. According to the latest monthly threat intelligence report from NCC Group, the ecosystem is undergoing a significant shift as dominant players consolidate their power while remnants of dismantled syndicates regroup under new banners. This uptick in malicious activity, which saw 198 successful campaigns last month, suggests that the temporary lull observed earlier this spring was merely a period of tactical recalibration rather than a permanent decline in the ransomware threat.

At the center of this volatile environment is Lockbit, specifically the group’s latest iteration, Lockbit 3.0. Having orchestrated 62 documented attacks in July alone—an increase of ten from the previous month—the group has effectively distanced itself from its competitors. Its current activity levels are more than double the combined output of its nearest rivals, solidifying its status as the most prolific threat actor in the current digital landscape. For security professionals and corporate risk officers, the message is clear: Lockbit’s operational capacity has reached a level of maturity that demands heightened vigilance and proactive threat hunting across all sectors.

The Fragmentation of Conti and the Rise of Successor Groups

To understand the current surge, one must look back at the geopolitical and law enforcement pressures applied to the ransomware underworld earlier this year. For years, the Conti syndicate operated as the undisputed kingpin of the ransomware economy, commanding a vast network of affiliates and developers. However, the group’s stability began to fracture in early 2022. Following a controversial public stance on the conflict in Ukraine, internal leaks exposed the group’s organizational structure, financial dealings, and private communications.

This exposure provided international law enforcement agencies, led primarily by the United States, with a roadmap to dismantle the organization. In May 2022, the U.S. Department of State took the unprecedented step of offering a reward of up to $15 million for information leading to the identification or location of key members of the Conti leadership. This move, combined with global pressure from agencies like the FBI and CISA, forced the syndicate to disband.

However, the dissolution of a major cybercriminal enterprise rarely results in the total cessation of its members’ activities. Instead, as the NCC Group data indicates, the human capital of Conti has simply migrated. The emergence of Hiveleaks and BlackBasta—the second and third most active groups in July—serves as a case study in criminal evolution. Hiveleaks reported a 440 percent surge in activity since June, reaching 27 attacks, while BlackBasta saw a 50 percent increase, totaling 24 incidents. Security researchers have identified clear operational and structural links between these entities and the former Conti syndicate. It appears that the "Conti" brand has been retired in favor of more agile, smaller, and potentially less scrutinized operations that allow former affiliates to continue their campaigns under new labels.

Chronology of the 2022 Ransomware Flux

The trajectory of ransomware activity in 2022 has been characterized by sharp peaks and valleys, driven by a cycle of aggressive law enforcement intervention and criminal adaptation.

• March – April 2022: Ransomware activity reached a high-water mark, with nearly 300 campaigns recorded per month. During this period, the industry was still grappling with the full scale of the Conti syndicate’s reach.
• May 2022: The U.S. government intensified its bounty program against Conti. This served as a major turning point, leading to the public dissolution of the group and a temporary drop in total global ransomware incidents as threat actors retreated to restructure.
• June 2022: The market hit a temporary nadir. Threat groups were in the process of re-establishing their command-and-control structures. During this period, Lockbit began its aggressive expansion, filling the power vacuum left by the collapse of Conti.
• July 2022: The resurgence began in earnest. With 198 campaigns recorded, the total volume of attacks climbed by 47 percent compared to June. This period confirmed that the "reorganization" phase of the former Conti affiliates was largely complete, as groups like BlackBasta and Hiveleaks resumed consistent operations.

Data-Driven Analysis of the Threat Landscape

The data provided by NCC Group is gathered through continuous monitoring of "leak sites"—the public-facing portals where ransomware gangs post stolen data from victims who refuse to pay extortion demands. By scraping these sites, researchers are able to quantify the success rate of various RaaS operators.

The dominance of Lockbit 3.0 is particularly concerning because of the group’s technical sophistication. Unlike some RaaS models that rely on simple encryption, Lockbit 3.0 employs a modular framework that allows for rapid innovation in payload delivery and obfuscation. Their ability to conduct 62 attacks in a single month suggests a highly efficient internal structure, likely utilizing a vast network of initial access brokers (IABs) who specialize in breaching corporate perimeters before selling that access to the ransomware operators.

The rapid rise of Hiveleaks and BlackBasta is equally telling. The 440 percent increase in Hiveleaks’ activity suggests a concerted effort by former Conti members to regain their former market share. While the total number of attacks has not yet reached the heights of early spring, the trend line is unmistakably positive for the attackers and increasingly dangerous for global industry.

Implications for Global Cybersecurity

The implications of this shift are profound for both the private sector and public policy. First, the restructuring of these groups indicates that "decapitation" strategies—targeting the leadership of a single group—may have limited long-term effectiveness if the underlying infrastructure and personnel remain intact. When a major group is forced to close, its members do not leave the industry; they disperse, bringing their specialized skills to other groups or forming new, smaller, and more resilient entities.

Second, the industry must prepare for a more fragmented, yet equally prolific, threat landscape. With Lockbit acting as the primary force and former Conti affiliates competing for the remaining market share, the frequency of attacks is likely to continue rising throughout the remainder of the year. Experts suggest that as these new groups compete to prove their capabilities, they may adopt more aggressive extortion tactics, such as combining data exfiltration with triple-extortion schemes—where attackers threaten not only the victim but also their clients, employees, and stakeholders.

Strategic Recommendations for Organizations

In light of the current threat landscape, security analysts recommend that organizations move beyond perimeter-based defenses. The shift toward RaaS means that ransomware gangs are increasingly using legitimate remote management tools and stolen credentials to gain entry, making traditional antivirus solutions insufficient.

1. Prioritize Identity and Access Management (IAM): Since the majority of ransomware incidents originate from stolen credentials, the implementation of robust multi-factor authentication (MFA) is no longer optional.
2. Continuous Monitoring: As groups like Lockbit 3.0 refine their delivery methods, organizations must implement 24/7 security operations center (SOC) monitoring to detect lateral movement within the network.
3. Threat Intelligence Integration: Keeping pace with the evolving tactics of splinter groups like BlackBasta is essential. Organizations should integrate current threat intelligence feeds into their security stacks to stay informed about the specific indicators of compromise (IoCs) associated with these emerging threats.
4. Resilient Backup Strategies: Given the persistence of these groups, the ability to recover from a compromise without paying a ransom remains the most critical defensive capability. Air-gapped and immutable backups are essential components of any modern disaster recovery plan.

As we move into the final months of the year, the data indicates that the ransomware economy is far from defeated. On the contrary, the structural changes that occurred during the summer months have created a more diverse and persistent threat ecosystem. The emergence of new entities from the ashes of Conti, coupled with the continued expansion of Lockbit, suggests that the cycle of ransomware will remain a primary challenge for IT and security professionals for the foreseeable future. Organizations must maintain a posture of constant vigilance, recognizing that the threat of a cyber-attack is now a permanent, evolving feature of the digital economy.