Ransomware Resurgence: LockBit Dominates as Conti’s Successors Drive Alarming Increase in Cyber Attacks

The digital threat landscape is once again shifting, with ransomware attacks experiencing a significant resurgence after a brief lull. Data compiled by the NCC Group reveals a concerning trend: LockBit has firmly established itself as the summer’s most prolific ransomware group, significantly outperforming its competitors. Close behind, two emergent groups, Hiveleaks and BlackBasta, identified as direct offshoots of the formidable Conti syndicate, are rapidly escalating their activities, collectively signaling a robust return of ransomware-as-a-service (RaaS) operations. This latest wave underscores the adaptability and persistent threat posed by sophisticated cybercriminal organizations, even in the face of concerted international efforts to dismantle them.

LockBit’s Unchallenged Ascendancy in July

According to the NCC Group’s Monthly Threat Pulse for July 2022, which meticulously monitors the leak sites utilized by various ransomware groups and scrapes victim details upon their release, LockBit was unequivocally the most active ransomware gang during the month. The group was implicated in 62 attacks, marking a notable increase of ten incidents compared to the previous month. This figure represents more than double the combined total of the second and third most prolific groups, underscoring LockBit 3.0’s (also known as LockBit Black) dominant position. Cybersecurity experts cited in the report emphasized, "Lockbit 3.0 maintain their foothold as the most threatening ransomware group, and one with which all organizations should aim to be aware of." This stark warning highlights the pervasive danger LockBit poses to organizations across various sectors globally.

LockBit’s operational model, which includes a highly efficient ransomware-as-a-service (RaaS) program, has allowed it to scale its operations rapidly. The group is known for its speed in encrypting systems and its use of "triple extortion" tactics, which involve not only encrypting data but also exfiltrating sensitive information for public release on leak sites and, in some cases, launching denial-of-service (DDoS) attacks against victims. This multi-pronged approach significantly increases pressure on victims to pay the ransom, often demanded in cryptocurrency, to prevent data exposure and operational paralysis. The group’s innovative strategies, including a purported bug bounty program for its ransomware, demonstrate a sophisticated and business-like approach to cybercrime, further solidifying its status as a top-tier threat actor.

The Rise of Conti’s Successors: Hiveleaks and BlackBasta

Trailing LockBit’s significant lead, Hiveleaks and BlackBasta emerged as the second and third most active ransomware groups in July, responsible for 27 and 24 attacks, respectively. These figures represent an alarming escalation in their activities. Hiveleaks experienced a staggering 440 percent increase in attacks since June, while BlackBasta saw a 50 percent rise over the same period. The rapid acceleration of these two groups is not coincidental; it is intrinsically linked to the recent structural shifts within the notorious Conti ransomware syndicate.

Both Hiveleaks and BlackBasta have been identified by the NCC Group as directly associated with Conti. Hiveleaks is believed to operate as an affiliate network, leveraging the infrastructure and possibly some of the expertise of former Conti operatives. BlackBasta, on the other hand, is considered a direct replacement strain, indicating a more direct lineage and perhaps a rebranding or restructuring of core Conti development teams. "As such, it appears that it has not taken long for Conti’s presence to filter back into the threat landscape, albeit under a new identity," the report authors noted. This fragmentation and re-emergence under new banners illustrate the resilience of organized cybercrime, making it challenging for law enforcement and cybersecurity agencies to effectively dismantle these networks permanently.

A Broader Resurgence: 47% Increase in Ransomware Campaigns

The July data reflects a broader upward trend in ransomware activity. NCC Group researchers recorded 198 successful ransomware campaigns during the month, marking a 47 percent increase compared to June. While this surge is sharp and concerning, it still falls short of the peak observed in Spring 2022, when nearly 300 such campaigns were recorded in both March and April. This fluctuation suggests a cyclical pattern, potentially influenced by various factors including geopolitical events, law enforcement actions, and the internal dynamics of cybercriminal groups.

The overall increase in ransomware attacks poses a significant threat to global businesses, critical infrastructure, and governmental entities. The financial toll of these attacks includes not only direct ransom payments but also the substantial costs associated with incident response, system recovery, reputational damage, and potential regulatory fines. Industry reports often estimate the global cost of ransomware in the tens of billions of dollars annually, with projections indicating further increases as threat actors refine their tactics and targets. The ease of access to RaaS tools, coupled with the anonymity afforded by cryptocurrencies and the dark web, continues to fuel this lucrative illicit industry.

Chronology of Flux: The Conti Saga and Government Intervention

The observed "flux" in ransomware activity, particularly the dip earlier in the year and the subsequent resurgence led by Conti’s offshoots, can be traced back to significant government intervention. In May, the United States government dramatically ramped up its efforts against Russian cybercrime. The U.S. State Department announced a reward offer of up to $15 million for information leading to the identification and location of key individuals associated with the Conti ransomware variant. This unprecedented bounty targeted what was, at the time, the world’s foremost ransomware gang, known for its extensive operations and alleged ties to the Russian state.

This aggressive move by the U.S. government was widely interpreted as a direct response to Conti’s persistent and impactful attacks on critical infrastructure and businesses globally. The pressure exerted by such a high-profile bounty, coupled with increased international cooperation among law enforcement agencies, is believed to have disrupted Conti’s operations significantly. "It is likely that the threat actors that were undergoing structural changes," the NCC Group authors speculated, referring to the immediate aftermath of the U.S. government’s action. This period of internal reorganization and adaptation by the Conti syndicate likely contributed to the temporary dip in overall ransomware attacks.

However, the resilience of these criminal networks means that disruption often leads to evolution rather than eradication. The fragmentation of Conti into new, albeit familiar, entities like Hiveleaks and BlackBasta is a prime example of this adaptive capacity. Rather than disappearing, the core elements of the Conti operation — its developers, affiliates, and technical infrastructure — appear to have reconstituted themselves under new banners. This strategic maneuver allows them to evade direct sanctions and bounties while continuing their illicit activities. The report authors concluded, "Now that Conti’s properly split in two, it would not be surprising to see these figures further increase as we move into August." This prediction highlights the ongoing challenge of combating highly organized and fluid cybercriminal enterprises.

The Mechanics of RaaS and Cybercrime Ecosystem

To fully appreciate the current landscape, it’s crucial to understand the ransomware-as-a-service (RaaS) model. RaaS operates much like a legitimate software business, but for illegal purposes. The developers, often highly skilled coders, create the ransomware strains, maintain the infrastructure (such as payment portals and leak sites), and provide technical support. They then recruit affiliates — individuals or groups who carry out the actual attacks by finding vulnerabilities, gaining initial access to target networks, and deploying the ransomware. Profits are typically split between the developers and the affiliates, with the developers taking a significant percentage (e.g., 20-30%) and the affiliates retaining the rest.

This model lowers the barrier to entry for cybercriminals, enabling individuals with less technical prowess to participate in lucrative ransomware schemes. It also creates a robust, decentralized ecosystem that is difficult to disrupt. When one group is targeted, its affiliates and developers can simply migrate to another RaaS program or launch their own, as seen with the Conti splintering. The presence of leak sites, where stolen data is publicly posted if the ransom is not paid, adds another layer of pressure on victims. These sites serve as a public record of successful attacks and a tool for "double extortion," amplifying the reputational and legal risks for compromised organizations.

Broader Implications and Future Outlook

The resurgence of ransomware, spearheaded by LockBit and the Conti offshoots, carries significant implications for cybersecurity strategy, national security, and global economic stability. For businesses, the imperative to bolster cyber defenses has never been greater. This includes implementing robust backup and recovery strategies, deploying multi-factor authentication (MFA), regular patching of systems, employee cybersecurity training, and developing comprehensive incident response plans. The "assume breach" mentality is becoming increasingly critical, requiring organizations to not only prevent attacks but also to prepare for their inevitable occurrence.

From a governmental perspective, the challenge lies in sustaining pressure on these adaptable criminal organizations while fostering international cooperation. The U.S. State Department’s bounty on Conti members was an innovative approach, and similar tactics may be employed against other high-profile groups. However, the effectiveness of such measures is often tempered by the ability of these groups to rebrand and reorganize, particularly when operating from jurisdictions that offer safe harbor or lack the political will to prosecute. The geopolitical dimension, especially concerning state-sponsored or state-tolerated cybercrime originating from countries like Russia, adds another layer of complexity to the fight against ransomware.

Cybersecurity analysts predict that the trend of ransomware fragmentation and re-emergence will likely continue. The ongoing cat-and-mouse game between threat actors and defenders means that new variants and operational structures will consistently emerge. Organizations must remain vigilant, prioritize threat intelligence, and adopt a proactive security posture to mitigate the risks. The July data serves as a critical reminder that while law enforcement efforts can disrupt, they rarely fully dismantle, necessitating a continuous and adaptive defense strategy against the ever-evolving landscape of cyber threats. The expectation of further increases in attack figures as the summer progresses underscores the urgent need for enhanced cybersecurity resilience across all sectors.