Lockbit Dominates Threat Landscape as Conti Offshoots Fuel a 47 Percent Surge in Summer Ransomware Attacks

Global cybersecurity researchers have recorded a sharp and concerning resurgence in ransomware deployments, driven predominantly by the relentless expansion of the Lockbit syndicate and the rapid operational rebirth of factions formerly tied to the notorious Conti gang. According to threat intelligence data released by the NCC Group, July witnessed 198 successful ransomware campaigns globally, marking a steep 47 percent increase from the figures recorded just one month prior.

While the mid-summer spike remains below the peak volumes observed earlier in the spring—when researchers documented nearly 300 successful attacks in both March and April—the sudden upward trajectory signals that major cybercriminal cartels have successfully adapted to international law enforcement pressures, geopolitical disruptions, and structural reorganizations. At the center of this malicious renaissance is Lockbit 3.0, alongside emerging and rebranded factions that trace their lineage directly to the now-defunct Conti infrastructure.

The Chronology of the Conti Collapse and Underground Restructuring

To understand the current composition of the ransomware ecosystem, cybersecurity analysts point to a volatile timeline of international pressure and underground fragmentation that reshaped the threat landscape during the first half of the year.

In the wake of geopolitical tensions and the outbreak of conflict in Eastern Europe, the Conti ransomware syndicate—long considered the most lucrative and organized cybercrime operation in the world—publicly declared its allegiance to the Russian government. This political alignment triggered an immediate and unprecedented counter-offensive from Western cybersecurity agencies and private threat intelligence firms. Internal chat logs, source code, and financial wallets belonging to Conti were systematically leaked online by disgruntled associates, effectively crippling the group’s centralized brand.

Recognizing the untenable heat surrounding the Conti name, key operators and affiliates initiated a strategic dissolution of the enterprise. By May, the United States Department of State escalated its efforts by offering financial rewards of up to $15 million for information leading to the identification or location of key Conti leadership figures. This high-stakes bounty forced the syndicate to accelerate its decentralization.

Rather than vanishing, however, the human capital, technical infrastructure, and extortion expertise behind Conti merely fractured into smaller, more agile offshoots. By early summer, these splinter cells began establishing new operational models, quietly re-entering the threat landscape under novel monikers and affiliation structures. By July, these reorganized entities had completed their transitional phases, leading directly to the dramatic surge in successful compromises observed by NCC Group researchers.

Quantitative Breakdown: Lockbit Leads the Pack While Conti Offshoots Surge

Data compiled through active monitoring of public leak sites—where cybercrime gangs publish stolen corporate data to coerce ransom payments—reveals stark figures regarding market share within the illicit industry.

Lockbit firmly retained its position as the world’s most prolific ransomware-as-a-service (RaaS) operation, accounting for 62 confirmed attacks in July alone. This represents an increase of ten attacks compared to June, cementing Lockbit 3.0 as a pervasive threat to global enterprises, critical infrastructure, and municipal systems. To put Lockbit’s dominance into perspective, the group executed more than twice as many attacks as its closest competitors combined. Researchers have repeatedly emphasized that organizations of all sizes must maintain vigilance against Lockbit’s automated affiliate model, which frequently leverages zero-day exploits, double extortion tactics, and aggressive affiliate recruitment programs.

Trailing far behind Lockbit, yet exhibiting explosive growth, are Hiveleaks and BlackBasta—two entities intimately connected to the structural ashes of Conti. Hiveleaks recorded 27 attacks in July, representing a staggering 440 percent increase from June activity. Meanwhile, BlackBasta accounted for 24 attacks, marking a 50 percent month-over-month rise.

According to threat intelligence assessments, Hiveleaks operates primarily within the traditional affiliate framework, absorbing former Conti foot soldiers who rent out sophisticated locker software in exchange for a percentage of the ransom. BlackBasta, conversely, is assessed by many analysts to be a direct evolution or replacement strain utilizing proprietary encryption tools and highly refined social engineering tactics reminiscent of Conti’s elite operational units.

The convergence of these statistics underscores a troubling reality: law enforcement disruptions can successfully dismantle a brand name, but without physical arrests or the neutralization of key operators, the underlying cybercriminal talent pool quickly reorganizes into more resilient, distributed networks.

Official Responses and Law Enforcement Counter-Measures

Governments and international law enforcement agencies have not remained passive in the face of escalating ransomware campaigns. The deployment of multi-million-dollar rewards by the U.S. State Department represents a cornerstone of a broader whole-of-government strategy aimed at imposing tangible costs on state-aligned or state-tolerated cybercriminals operating primarily out of jurisdictions with minimal extradition treaties.

In addition to financial bounties, international task forces—including Europol, the U.S. Federal Bureau of Investigation (FBI), and the UK’s National Crime Agency (NCA)—have increasingly focused on infrastructure takedowns, cryptocurrency seizure, and the dissemination of decryption keys to victims. Earlier coordinated actions against servers utilized by various RaaS variants have successfully blunted the immediate impact of several attacks, forcing threat actors to adopt decentralized communication channels and more elusive hosting providers.

However, industry experts note that law enforcement initiatives often prompt temporary lulls followed by rapid rebounds. The dip in ransomware activity observed in late spring directly coincided with the final operational collapse of Conti, but the subsequent 47 percent surge in July demonstrates the elasticity of the cybercrime economy. When one syndicate dissolves or goes underground, the vacuum is rapidly filled by ambitious affiliates and splinter cells eager to claim market share.

Implications for Enterprise Security and Future Outlook

The evolving tactics of dominant groups like Lockbit and the resurrected factions of Conti carry profound implications for corporate cybersecurity postures and risk management frameworks.

Traditional perimeter defense models—relying heavily on basic firewalls and signature-based antivirus solutions—are increasingly inadequate against RaaS operations that leverage living-off-the-land techniques, legitimate administrative tools, and credential theft to move laterally through corporate networks. The widespread adoption of double and triple extortion models, where threat actors not only encrypt local files but also threaten to leak proprietary intellectual property or launch distributed denial-of-service (DDoS) attacks against uncooperative victims, requires a fundamental shift in incident response planning.

Cybersecurity analysts project that as these newly formed splinter groups continue to refine their operational efficiencies and establish independent revenue streams, attack volumes are likely to maintain an upward trajectory throughout the remainder of the year. Organizations are strongly advised to implement robust zero-trust architectures, enforce multi-factor authentication (MFA) across all administrative portals, maintain immutable and air-gapped backups, and conduct regular penetration testing to identify vulnerabilities before threat actors can exploit them.

As the digital battlefield adapts to the post-Conti reality, the persistence of syndicates like Lockbit and its fast-rising competitors serves as a stark reminder of the adaptability inherent in modern cybercrime syndicates. Without sustained, cross-border operational disruptions and heightened baseline security hygiene across global industries, the ransomware epidemic will continue to impose severe financial and operational tolls on the worldwide economy.