Lockbit and Resurgent Conti Offshoots Drive 47 Percent Surge in Global Ransomware Attacks

The global cybersecurity landscape experienced a sharp and alarming resurgence in extortion-based cyberattacks mid-year, driven primarily by the relentless expansion of the Lockbit syndicate and the rapid operational rebirth of factions formerly tied to the notorious Conti group. According to comprehensive threat intelligence data released by the NCC Group in its July 2022 Threat Pulse, successful ransomware campaigns surged by 47 percent globally in a single month, rebounding from a temporary spring dip induced by aggressive international law enforcement actions.

Researchers monitoring the digital underworld recorded 198 successful ransomware attacks in July, a significant escalation from the 135 incidents logged in June. While this figure remains below the peak levels observed in March and April—during which threat actors orchestrated nearly 300 successful compromises per month—the sudden upward trajectory has triggered renewed urgency among enterprise security teams, government agencies, and incident response firms worldwide.

At the center of this malicious renaissance is Lockbit, operating under its latest iteration, Lockbit 3.0. The syndicate cemented its status as the summer’s most prolific ransomware-as-a-service (RaaS) operation, accounting for 62 attacks in July alone. This staggering volume represents a ten-attack increase over its June performance and outpaces the combined totals of the second and third most active threat groups in the ecosystem. Security analysts emphasize that Lockbit’s robust infrastructure, aggressive affiliate recruitment model, and continuous refinement of its cryptographic locking mechanisms make it one of the most formidable threats facing corporate and governmental networks today.

The Anatomy of July’s Cyber Offensive

To understand the mechanics behind July’s surge, cybersecurity researchers rely on continuous monitoring of dark web leak sites, where extortionists publish stolen corporate data to coerce victims into paying multi-million-dollar ransoms. By actively scraping these repositories as victim profiles are posted, analysts can map out threat actor activity with remarkable precision.

While Lockbit dominated the upper echelon of the threat matrix, the most dramatic shifts occurred directly beneath it. The second most prolific group in July was Hiveleaks, which claimed responsibility for 27 attacks—representing an astonishing 440 percent month-over-month increase from June. Close behind was BlackBasta, registering 24 attacks, which marked a 50 percent surge over the same period.

When combined, these three syndicates—Lockbit, Hiveleaks, and BlackBasta—were responsible for the vast majority of July’s recorded disruptions, illustrating a high degree of market concentration within the cybercrime economy. The rapid ascent of Hiveleaks and BlackBasta is not an isolated phenomenon; rather, it reflects a profound structural evolution within the broader ransomware underground following the fragmentation of Russia-linked mega-cartel Conti.

The Fall of Conti and the Birth of New Offshoots

The trajectory of 2022’s cyber threat landscape has been inextricably linked to the geopolitical pressures placed on Conti, once universally recognized as the world’s most dominant and well-funded ransomware operation. Operating with near-impunity from jurisdictions that historically tolerated or turned a blind eye to domestic cybercriminals, Conti maintained a massive network of developers, negotiators, and deployment affiliates.

However, the geopolitical fallout from the conflict in Ukraine fundamentally altered this dynamic. In the early months of 2022, internal dissension fractured Conti after the group publicly declared its full support for the Russian government, prompting disaffected members to leak source code, internal chat logs, and operational infrastructure. Capitalizing on this internal chaos, the United States Department of State escalated its offensive posture in May 2022 by issuing a reward of up to $15 million through its Rewards for Justice program for actionable information leading to the identification or location of key Conti co-conspirators.

This intense pressure forced Conti’s leadership to dismantle the centralized brand. Yet, rather than exiting the criminal ecosystem, the highly skilled individuals comprising the enterprise did not vanish; they adapted. Threat intelligence analysts quickly identified that the human capital behind Conti was actively re-allocating its resources, establishing new operating models, and migrating to alternative platforms.

Hiveleaks, operating an aggressive RaaS model that frequently targets critical infrastructure and healthcare entities, absorbed former Conti affiliates looking for a stable operational home. Concurrently, BlackBasta emerged as a sophisticated replacement strain, utilizing advanced encryption routines and double-extortion tactics that bore the unmistakable stylistic hallmarks of former Conti core developers.

By July, these restructuring efforts had matured. The threat actors successfully settled into their new operational paradigms, resulting in a dramatic increase in successful compromises. Industry analysts note that it took remarkably little time for Conti’s operational DNA to filter back into the primary threat landscape, albeit decentralized and distributed across multiple distinct brand identities.

Broader Economic and Operational Implications

The resurgence of ransomware-as-a-service highlights structural vulnerabilities in how modern organizations approach cyber resilience. The RaaS business model functions much like legitimate enterprise software: developers build and maintain the malicious code, negotiate digital ransom payments, and provide customer support infrastructure, while independent affiliates handle the initial network intrusion, lateral movement, and payload deployment. This division of labor allows threat groups to scale operations efficiently, bypassing traditional perimeter defenses through credential stuffing, phishing, and exploitation of unpatched software vulnerabilities.

The financial and operational fallout for victim organizations extends far beyond the immediate extortion demands. Beyond the direct costs of ransom payments—which frequently range from hundreds of thousands to tens of millions of dollars—affected enterprises face protracted business interruption, forensic investigation expenses, regulatory fines, and reputational damage. In sectors such as manufacturing, healthcare, and professional services, a multi-day network outage can paralyze supply chains and compromise sensitive client data.

Furthermore, the diversification of the threat landscape into splinter groups like Hiveleaks and BlackBasta complicates law enforcement efforts. While dismantling a single monolithic entity like Conti provided a clear strategic objective for international task forces, tracking dozens of agile, fast-evolving affiliates requires unprecedented levels of cross-border intelligence sharing and real-time private-public collaboration.

Outlook and Defensive Recommendations

As the cybersecurity community transitioned from mid-summer into August 2022, threat intelligence analysts warned that the upward trajectory of ransomware campaigns showed no immediate signs of abating. With Lockbit 3.0 entrenched as an industry titan and Conti’s successor factions fully operationalized, the volume of attacks is projected to remain elevated.

In response to these evolving threats, cybersecurity authorities—including the Cybersecurity and Infrastructure Security Agency (CISA) and the National Cyber Security Centre (NCSC)—continue to urge organizations to adopt a defense-in-depth posture. Critical mitigation strategies include the implementation of robust multi-factor authentication (MFA) across all remote access and administrative accounts, rigorous patch management schedules to address known vulnerabilities, network segmentation to limit lateral movement, and the maintenance of immutable, offline data backups that cannot be encrypted or deleted by ransomware payloads.

Ultimately, the events of July 2022 serve as a stark reminder of the resilience and adaptability of the cybercrime economy. As long as extortion remains highly lucrative, threat actors will continue to innovate, reorganize, and exploit systemic vulnerabilities, necessitating perpetual vigilance from defenders across every sector of the global economy.