Lockbit Reign Supreme as Global Ransomware Attacks Surge in July Driven by Conti Offshoots and RaaS Evolution

The global cybersecurity landscape experienced a sharp and concerning resurgence in malicious cyber activity throughout July, driven primarily by established ransomware-as-a-service (RaaS) operations and splinter factions of dismantled criminal syndicates. According to threat intelligence data released by the NCC Group, successful ransomware campaigns rebounded significantly following a brief springtime dip, registering a 47 percent increase month-over-month. Researchers logged a total of 198 successful attacks globally in July, up from June’s figures, signaling a rapid recalibration of major cybercriminal organizations in the wake of mounting international law enforcement pressure.

At the center of this malicious surge is Lockbit—specifically its iteration Lockbit 3.0—which solidified its position as the summer’s most prolific and pervasive ransomware threat. Operating on a RaaS model that recruits affiliates to deploy extortion payloads, Lockbit was attributed to 62 separate attacks in July alone. This staggering figure represents an increase of ten attacks compared to the previous month and outpaces the combined totals of the second and third most active threat groups. Cybersecurity analysts note that Lockbit’s robust infrastructure, consistent innovation, and aggressive double-extortion tactics continue to present a clear and present danger to enterprises, critical infrastructure, and public institutions worldwide.

The Main Facts: A Mid-Summer Surge

The July threat intelligence report paints a vivid picture of a threat landscape that, while remaining below the historic highs recorded earlier in the spring, is rapidly recovering its momentum. In March and April, researchers observed nearly 300 successful ransomware campaigns per month, a peak driven by a combination of legacy syndicates and opportunistic affiliates. However, coordinated geopolitical actions and targeted law enforcement interventions disrupted these operations significantly toward the end of the spring, causing a temporary contraction in May and June.

By July, however, the ecosystem had fully adapted. The resurgence was not spearheaded by newly formed entities, but rather by seasoned cybercriminal groups that successfully reorganized their operational frameworks, established new leak sites, and recruited fresh waves of affiliates. Lockbit’s dominance underscored this trend, demonstrating that well-funded and structurally mature RaaS operations are remarkably resilient to regulatory and law enforcement headwinds. Behind Lockbit, the threat landscape was heavily influenced by organizations tied directly to the fallout of the Conti syndicate, a Russian-speaking collective that dominated the cybercrime economy throughout 2021 and early 2022 before collapsing under the weight of political scrutiny and internal leaks.

Chronology of Disruption: From Conti’s Collapse to the Rise of Hiveleaks and BlackBasta

To understand the current composition of the ransomware economy, it is necessary to examine the cascading events that fractured the ecosystem earlier in the year. The chronology of this transformation highlights the fluid and adaptable nature of modern cybercrime syndicates.

In February 2022, following the outbreak of the Russia-Ukraine conflict, internal communications and source code belonging to the Conti ransomware group were leaked online by a disgruntled affiliate. This unprecedented data dump exposed the identities, financial workflows, and infrastructure of one of the world’s most sophisticated cyber extortion rings.

Recognizing the untenable exposure of the Conti brand, its leadership orchestrated a strategic dissolution of the monolithic group. Rather than vanishing, the core operators elected to decentralize, splitting their human capital, financial resources, and malware tools into smaller, more agile cells to evade targeted sanctions and law enforcement tracking.

In May 2022, the United States Department of State escalated its counter-offensive against Russian-affiliated cybercrime by issuing a reward of up to $15 million through its Rewards for Justice program for information leading to the identification or location of key Conti leadership figures. This high-profile bounty placed immense pressure on remaining infrastructure associated with the gang.

By June and July, the structural dust began to settle. Threat intelligence analysts monitoring dark web leak sites and victim forums observed the emergence and rapid expansion of two distinct groups intimately tied to the former Conti apparatus: Hiveleaks (utilizing the Hive ransomware variant) and BlackBasta, a newly engineered strain that bore striking infrastructural and tactical resemblances to Conti’s legacy operations.

Supporting Data: Quantifying the Threat

The statistical breakdown provided by the NCC Group underscores the dramatic trajectory of these emerging syndicates. In July, Hiveleaks surged into the second-most prolific threat group globally, claiming responsibility for 27 successful attacks. This figure represents an extraordinary 440 percent increase in activity compared to June, illustrating how quickly former Conti affiliates integrated into—or adopted—the Hive framework.

Simultaneously, BlackBasta claimed 24 attacks in July, securing its place as the third most active ransomware gang. This marked a 50 percent increase from the previous month. Combined, Hiveleaks and BlackBasta accounted for 51 publicized victim organizations, nearly matching Lockbit’s output and demonstrating that the void left by Conti’s fragmentation has been swiftly filled by its direct successors.

Meanwhile, Lockbit continued to widen its lead at the top of the hierarchy. Responsible for 62 attacks in July—up from 52 in June—Lockbit accounted for nearly one-third of all global ransomware incidents tracked by the NCC Group during the period. The group’s output was more than double the combined totals of Hiveleaks and BlackBasta, cementing Lockbit 3.0 as the most formidable and ubiquitous threat facing organizations today.

Official Responses and Law Enforcement Strategy

Governments and international law enforcement agencies have not remained idle in the face of this persistent cyber threat. The transition from monolithic gangs like Conti to decentralized, cell-based RaaS models has forced intelligence agencies to adapt their methodologies, shifting from high-profile infrastructure seizures to targeted financial disruptions and international indictments.

Law enforcement bodies, including Europol, the United States Federal Bureau of Investigation (FBI), and the UK’s National Crime Agency (NCA), have increasingly focused on disrupting the cryptocurrency laundering networks that underpin the ransomware business model. By collaborating with blockchain analysis firms and international financial institutions, authorities have successfully frozen millions of dollars in ransom payments and unmasked key facilitators who bridge the gap between cybercriminals and legitimate financial systems.

Furthermore, public-private partnerships have played a crucial role in mitigating the impact of groups like Lockbit, Hiveleaks, and BlackBasta. Cybersecurity firms routinely share threat intelligence indicators—such as command-and-control IP addresses, malware hashes, and known vulnerabilities—with enterprise security teams, enabling proactive defense measures before attacks can be successfully executed. Government cybersecurity agencies, such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA), continue to issue joint advisories detailing the tactics, techniques, and procedures (TTPs) utilized by these specific RaaS affiliates, urging organizations to implement mandatory multifactor authentication (MFA), regular offline backups, and robust patch management programs.

Broader Impact and Implications for Global Enterprise

The July surge in ransomware attacks carries profound implications for the global business community, highlighting the persistent fragility of digital supply chains and IT infrastructure. As threat actors refine their operations and recover from geopolitical disruptions, organizations across all sectors—ranging from healthcare and education to manufacturing and financial services—remain prime targets for extortion.

The evolution of the RaaS model has democratized advanced cybercrime, allowing lower-skilled criminals to lease sophisticated encryption tools and leverage pre-built infrastructure. Consequently, organizations can no longer rely on perimeter defense alone to secure their assets. The shift toward decentralized groups like Hiveleaks and BlackBasta demonstrates that dismantling a single major syndicate does not eradicate the underlying threat; instead, it frequently catalyzes the birth of multiple, more agile splinter groups that intensify their operations to re-establish dominance and revenue streams.

Industry analysts warn that as these groups settle into their new operational paradigms, attack volumes are likely to experience further upward pressure through the remainder of the year. Security experts emphasize that organizations must adopt a posture of continuous resilience—assuming breach conditions, enforcing zero-trust architecture, and conducting regular incident response simulations. Only through a combination of proactive technological defenses, rigorous employee training, and international law enforcement cooperation can the global community hope to stem the tide of this relentless digital extortion epidemic.