Lockbit Reclaims Crown as Global Ransomware Activity Surges Following Conti Restructuring

The global cybersecurity landscape experienced a significant and alarming resurgence in extortion operations as summer progressed, driven primarily by the relentless expansion of the Lockbit syndicate and the rapid operational rebirth of factions formerly tied to the dismantled Conti group. According to comprehensive threat intelligence data released by the NCC Group, successful ransomware attacks climbed sharply by 47 percent in July, rebounding from a temporary spring lull that had followed aggressive international law enforcement actions.

Researchers monitoring the digital underworld recorded 198 successful ransomware campaigns globally during the month of July. While this total remains comfortably below the high-water marks established earlier in the year—when March and April both saw nearly 300 targeted campaigns—the sudden upward trajectory has put security operations centers worldwide on high alert. The driving force behind this mid-summer surge is a combination of established extortion heavyweights updating their malicious software platforms and displaced operatives from dissolved syndicates successfully re-establishing their criminal enterprises under new banners.

Lockbit Solidifies Dominance With Lockbit 3.0

At the center of the July surge is the Lockbit ransomware-as-a-service (RaaS) operation. By actively monitoring dark web leak sites and scraping corporate victim data the moment it is published, cybersecurity researchers determined that Lockbit was responsible for an astonishing 62 attacks in July alone. This figure represents a notable ten-attack increase over its performance in June and places the group far ahead of any other competitor in the threat landscape.

Lockbit’s current output is more than double the combined total of the second and third most prolific threat actors active during the same period. Operating primarily through a sprawling affiliate network, the group successfully deployed its latest iteration, Lockbit 3.0—also known as Lockbit Black—which features updated evasion techniques, refined cryptocurrency exfiltration methods, and a bug bounty program designed to attract external security researchers and developers to improve their malicious tooling.

Cybersecurity analysts emphasize that Lockbit 3.0 has successfully cemented its foothold as the most pervasive and dangerous ransomware threat facing global enterprises today. The group’s business model relies heavily on affiliates who breach corporate perimeters, deploy the Lockbit payload, and then negotiate extortion demands directly with victims, with the core developers taking a percentage of the illicit proceeds.

The Conti Diaspora: The Rise of Hiveleaks and BlackBasta

While Lockbit commands the highest volume of attacks, the most dynamic movement within the July threat intelligence data centers on the profound restructuring of actors previously aligned with Conti. Earlier in the year, Conti—historically recognized as one of the world’s most aggressive and profitable Russian-speaking cybercrime syndicates—dissolved its centralized operations following intense international pressure, internal ideological fractures stemming from the geopolitical conflict in Ukraine, and massive data leaks that exposed its internal communications and infrastructure.

The dissolution of Conti did not, however, eliminate the threat actors; rather, it initiated a diaspora of skilled hackers, negotiators, and infrastructure administrators. In July, this structural evolution became starkly evident through the meteoric rise of two specific groups: Hiveleaks and BlackBasta.

Hiveleaks, which operates the Hive ransomware ecosystem, surged to become the second most prolific threat group in July, claiming responsibility for 27 successful attacks. This figure represents an extraordinary 440 percent increase in activity compared to the previous month. Concurrently, BlackBasta—a relatively new strain that emerged shortly after Conti’s collapse—accounted for 24 attacks in July, marking a 50 percent increase month-over-month and positioning the group as the third most active syndicate globally.

Threat intelligence analysts tracking the telemetry of these groups have established direct operational and infrastructural links between these syndicates and the remnants of Conti. Hiveleaks has integrated former Conti affiliates into its extortion framework, leveraging their established intrusion methodologies and initial access brokers. Meanwhile, BlackBasta is increasingly viewed by security researchers as a direct spiritual successor and operational replacement strain for Conti, utilizing similar post-compromise tactics, lateral movement techniques, and extortion portals.

The rapid recovery and scaling of these factions demonstrate the remarkable resilience of modern cybercrime syndicates. Despite severe coordinated pressure from Western governments, highly skilled cybercriminals can rapidly rebrand, divide, and scale their operations under new nomenclature without suffering permanent capability loss.

Chronology of a Crackdown: How Government Pressure Reshaped the Underworld

To understand the current proliferation of ransomware groups, industry analysts look back at the coordinated international pressure campaign that began in earnest in late 2021 and culminated in the spring of 2022. For years, major ransomware gangs operated with relative impunity from jurisdictions that offered safe havens, laundering their illicit cryptocurrency gains through decentralized mixing services and over-the-counter brokers.

The turning point for the modern threat landscape occurred when ransomware attacks began directly impacting critical infrastructure, energy pipelines, food supplies, and healthcare providers. In response, governments—led primarily by the United States Department of Justice, the Department of the Treasury, and European law enforcement agencies—began treating ransomware not merely as a localized cybercrime issue, but as a matter of national security.

In May, the United States Department of State escalated its offensive against Conti by issuing a reward offer of up to $15 million for actionable information leading to the identification or location of key leaders and co-conspirators within the Conti ransomware variant organization. This high-profile financial bounty, combined with targeted sanctions on cryptocurrency exchange platforms utilized by Russian cybercriminals and continuous takedown operations coordinated by Europol and the FBI, triggered the immediate fragmentation of Conti.

For several weeks following the bounty announcement, overall global ransomware numbers dipped as threat actors went underground, encrypted their communication channels, purged compromised servers, and initiated internal restructuring. However, threat intelligence reports from June and July indicate that this period of dormancy was merely a transition phase. Having established new operational security protocols, rebranded their strains, and redistributed their affiliate networks, these threat actors have successfully returned to full operational capacity, driving the July surge.

Broader Industry Impact and Strategic Implications

The resurgence of ransomware, characterized by Lockbit’s continued supremacy and the successful splintering of Conti into agile new entities, holds profound implications for enterprise security strategies, cyber insurance markets, and international policy.

First, the data underscores the failure of traditional perimeter-defense models in the face of sophisticated ransomware-as-a-service operations. Modern threat actors frequently bypass standard security controls by exploiting valid credentials, deploying living-off-the-land techniques, compromising managed service providers (MSPs), and exploiting unpatched zero-day vulnerabilities in remote access software. As groups like Lockbit, Hiveleaks, and BlackBasta refine their double-extortion tactics—whereby they not only encrypt corporate networks but also exfiltrate sensitive intellectual property, financial records, and employee personally identifiable information (PII) to threaten public publication—organizations face compounding operational and legal liabilities.

Second, the structural evolution of Conti into entities like BlackBasta and Hiveleaks highlights a fundamental resilience within the cybercrime economy. Law enforcement disruptions, while temporarily effective at scattering syndicates, often result in a hydra-headed effect where one centralized group breaks down into multiple, highly competitive smaller cells. These splinter groups frequently adopt even more aggressive tactics to prove their market viability and attract high-tier affiliates.

In response to these evolving threats, cybersecurity frameworks are rapidly shifting away from reactive prevention toward continuous threat exposure management, rigorous identity and access management (IAM), comprehensive multi-factor authentication (MFA) implementation, and robust offline, immutable data backup strategies. Security experts universally advise organizations against paying ransoms, noting that payment fuels the operational budgets of prolific groups like Lockbit and offers no absolute guarantee that exfiltrated data will be permanently destroyed.

As the cybersecurity community moves deeper into the second half of the year, threat intelligence analysts warn that the upward trend observed in July is unlikely to abate. With Conti’s former infrastructure fully integrated into new operational pipelines and Lockbit continuously upgrading its malware distribution models, organizations across all industry verticals—particularly manufacturing, professional services, healthcare, and finance—must maintain heightened vigilance, treat network intrusion as an inevitability, and prioritize rapid incident response capabilities to mitigate the fallout of modern digital extortion.