Lockbit Reigns Supreme as Global Ransomware Attacks Surge in Summer 2022 Driven by Conti Offshoots

The global cybersecurity landscape experienced a sharp and alarming resurgence in extortion operations during the summer of 2022, fueled heavily by entrenched ransomware-as-a-service (RaaS) enterprises and the splintered remnants of the notorious Conti syndicate. According to comprehensive threat intelligence data released by the NCC Group, successful ransomware campaigns climbed by 47 percent in July 2022 compared to the previous month, halting a brief springtime lull. At the epicenter of this malicious activity stands Lockbit—specifically its iteration, Lockbit 3.0—which cemented its status as the most prolific and aggressive threat actor operating in the digital ecosystem.

Cybersecurity analysts tracking underground leak sites and cataloging victim disclosures recorded a total of 198 successful ransomware campaigns worldwide in July. While this figure remains below the peak volumes observed earlier in the spring—when March and April both saw nearly 300 targeted attacks—the sudden upward trajectory has sounded alarms across corporate boardrooms, critical infrastructure operators, and international law enforcement agencies alike. The resurgence highlights the remarkable resilience of cybercrime business models, which continue to adapt, reorganize, and scale despite targeted geopolitical pressure and multi-million-dollar bounties offered by Western governments.

Lockbit 3.0 Dominates the Threat Landscape

Surpassing all industry competitors, Lockbit was responsible for 62 confirmed attacks in July 2022. This represents a significant escalation from the 52 attacks attributed to the group in June, dwarfing the output of its closest rivals. In fact, Lockbit’s July campaign total was more than double the combined output of the second and third most prolific threat groups active during the same period.

Security researchers tracking the group emphasize that Lockbit 3.0 has successfully maintained an operational foothold across diverse industry verticals, ranging from manufacturing and healthcare to professional services and education. The group’s sophisticated affiliate model, automated extortion platforms, and robust technological infrastructure have allowed it to sustain high-tempo operations. Consequently, cybersecurity professionals have repeatedly warned that organizations of all sizes must treat Lockbit as an omnipresent and severe risk to their digital assets.

The Anatomy of a Resurgence: Rise of the Conti Offshoots

While Lockbit claimed the highest volume of attacks, the broader macro-trend driving July’s 47 percent surge can be traced directly to structural transformations within the cybercrime underground, most notably the fracture of the Conti syndicate. Earlier in the year, Conti—widely regarded as the world’s most dominant and financially lucrative ransomware operation—faced immense pressure following its public expression of support for the Russian government’s invasion of Ukraine. This stance triggered massive internal leaks of its source code, operational chats, and Bitcoin wallet addresses, severely compromising its centralized command structure.

In May 2022, the United States Department of State escalated countermeasures by announcing rewards of up to $15 million under the Transnational Organized Crime Rewards Program for information leading to the identification or location of key Conti leadership figures and co-conspirators. Rather than dissolving entirely, the sprawling network of hackers, affiliates, and operators behind Conti systematically restructured.

This reorganization birthed or amplified several prominent spin-off strains that quickly climbed the July threat rankings. Hiveleaks (commonly known as Hive) recorded 27 attacks in July, representing a staggering 440 percent increase from June activity. Meanwhile, BlackBasta—a newer ransomware strain widely viewed by threat intelligence analysts as a direct operational successor or offshoot of Conti—surged to 24 attacks, marking a 50 percent increase month-over-month. Together, these two Conti-associated entities accounted for a massive share of the global ransomware footprint, proving that the dismantling of a primary brand often results in a hydra-like proliferation of smaller, highly active successor cells.

Chronology of the 2022 Ransomware Lifecycle

To understand the volatile nature of the cyberthreat ecosystem during the summer of 2022, it is necessary to examine the chronological progression of major enforcement actions and threat actor adaptations throughout the year:

• Early 2022 (January – February): Ransomware operations maintain a steady, high-volume baseline, with traditional RaaS models operating with relative impunity.
• Late February – March 2022: Following the geopolitical fallout in Eastern Europe, the Conti group openly aligns with the Russian government, triggering immediate internal dissent, data leaks by disgruntled members, and a fracturing of its core infrastructure.
• March – April 2022: Despite the internal chaos at Conti, global ransomware campaigns reach an annual peak, with NCC Group recording nearly 300 successful extortion campaigns in each of these months as various groups rush to monetize existing vulnerabilities.
• May 2022: The United States government officially intervenes with a $15 million bounty targeting Conti leadership. Threat actors associated with the syndicate initiate a large-scale operational retreat, dissolving centralized operations and scattering into smaller splinter cells and affiliate networks.
• June 2022: A temporary dip is observed across the threat landscape as Conti affiliates and displaced hackers pause operations to establish new infrastructure, rebrand, and adapt to shifting law enforcement pressures. NCC Group notes a relative lull in successful disclosures.
• July 2022: Ransomware attacks rebound dramatically by 47 percent, totaling 198 successful campaigns. Lockbit solidifies its dominance with 62 attacks, while Conti-linked successors Hiveleaks and BlackBasta surge by 440 percent and 50 percent, respectively, demonstrating that threat actors have successfully settled into new operational paradigms.

Methodology and Threat Intelligence Insights

The data underpinning these findings is gathered through rigorous, continuous monitoring methodologies employed by cybersecurity researchers. Rather than relying solely on voluntary breach disclosures—which are frequently underreported due to reputational and legal concerns—threat intelligence analysts actively monitor and scrape underground leak sites, dark web forums, and extortion portals operated by ransomware gangs.

When a victim organization fails to meet extortion demands within a stipulated deadline, threat actors typically publish stolen proprietary data, financial records, and employee information as leverage. By cataloging these leaks in real time, researchers gain an accurate, empirical view of industry trends, geographic targeting patterns, and the relative productivity of specific criminal syndicates.

Industry Analysis and Strategic Implications

The rapid recovery of the ransomware ecosystem following coordinated international pressure underscores a fundamental challenge in modern cybersecurity: the decentralized, agile nature of cybercrime syndicates makes them exceptionally difficult to permanently eradicate through financial bounties and sanctions alone.

When a dominant brand like Conti collapses, the intellectual capital, technical tooling, and network access brokers associated with it do not vanish. Instead, they disperse into the broader criminal economy, joining existing dominant platforms like Lockbit or forming aggressive new boutique operations like BlackBasta. This fluidity accelerates innovation, as competing groups rapidly adopt successful extortion techniques, such as triple-extortion schemes, public shaming, DDoS attacks against victims, and direct pressure on corporate clients and supply chain partners.

Furthermore, the dominance of Lockbit 3.0 highlights the ongoing effectiveness of the RaaS business model. By lowering the technical barrier to entry, core developers can lease their malicious infrastructure to lesser-skilled affiliates (often referred to as initial access brokers) in exchange for a percentage of the ransom payment. This division of labor allows criminal groups to scale operations globally, targeting organizations across diverse sectors simultaneously without exhausting internal resources.

Corporate Defense and Mitigation Strategies

In light of the July surge and the ongoing threat posed by Lockbit and Conti offshoots, cybersecurity experts and regulatory bodies continue to urge organizations to adopt robust, defense-in-depth security postures. Key recommended mitigation practices include:

• Comprehensive Patch Management: Prioritizing the rapid remediation of known vulnerabilities, particularly those frequently exploited by initial access brokers to gain entry into corporate networks.
• Multi-Factor Authentication (MFA): Implementing phishing-resistant MFA across all corporate accounts, remote access gateways, and administrative portals to prevent unauthorized credential harvesting.
• Immutable Backups: Maintaining isolated, encrypted, and regularly tested backup repositories that cannot be reached, modified, or deleted by ransomware deployment scripts.
• Network Segmentation: Restricting lateral movement within internal networks by segmenting critical infrastructure, limiting administrative privileges, and enforcing the principle of least privilege.
• Threat Intelligence Integration: Utilizing real-time threat feeds to monitor emerging indicators of compromise (IoCs) associated with active RaaS groups such as Lockbit, Hiveleaks, and BlackBasta.

As the cybersecurity community looks toward the remainder of the year, industry analysts widely anticipate that the momentum gained by these reconfigured threat actors in July will translate into sustained high-volume attacks throughout the autumn months. Organizations are therefore advised to treat ransomware resilience not as an isolated IT project, but as an ongoing, enterprise-wide operational priority.