Lockbit Solidifies Reign as Summer’s Most Prolific Ransomware Syndicate Amid Resurgence Stemming from Conti’s Restructuring

The global cybersecurity landscape experienced a significant and alarming upward shift in July, driven by a 47 percent surge in successful ransomware campaigns compared to the previous month. According to comprehensive threat intelligence data released by NCC Group, a prominent global cybersecurity firm, threat actors successfully executed 198 ransomware attacks globally in July, rebounding from a temporary lull observed earlier in the summer.

At the epicenter of this resurgence is Lockbit, operating primarily through its latest iteration, Lockbit 3.0, which has definitively established itself as the most dominant and threatening ransomware-as-a-service (RaaS) syndicate in operation today. Meanwhile, the broader ecosystem is being rapidly reshaped by the structural fragmentation of Conti—formerly the world’s most feared cybercrime cartel—which has birthed highly active splinter factions now dominating secondary positions on the threat leaderboard.

Main Facts and the July Surge

The latest monthly Threat Pulse report compiled by NCC Group researchers highlights a stark acceleration in cybercriminal activity. Analysts who actively monitor the illicit data leak sites used by ransomware gangs to extort victims recorded 198 attacks in July. This represents a substantial 47 percent bounce back from June figures, though it remains below the peak levels recorded earlier in the spring, when cyber campaigns approached the 300-mark in both March and April.

The undisputed heavyweight of this wave is Lockbit. In July alone, the Lockbit group was credited with 62 successful attacks. This metric marks a ten-attack increase from June and dwarfs the output of its nearest competitors. In fact, Lockbit’s July tally accounts for more than twice the combined total of the second and third most prolific syndicates operating during the same period.

Security researchers emphasize that Lockbit 3.0 has successfully maintained an aggressive posture, leveraging advanced affiliate models, robust encryption tools, and relentless double-extortion tactics. These tactics involve not only encrypting a victim’s core infrastructure but also threatening to leak sensitive proprietary data on public dark web portals unless a hefty cryptocurrency ransom is paid.

Chronology and Evolution of the Threat Landscape

To understand the current state of ransomware, industry analysts look back at the chaotic timeline that has defined the cybercrime underground over the past year.

Earlier in 2021 and continuing into early 2022, the Conti syndicate—believed to be based primarily in Eastern Europe—operated as a monolithic powerhouse. Conti notorious for its centralized command structure and massive financial windfalls, terrorized critical infrastructure, healthcare organizations, and multinational corporations alike.

However, the geopolitical fallout from the war in Ukraine served as a major turning point. In February 2022, following statements of allegiance to the Russian government, internal Conti chat logs and source code were catastrophically leaked by a disgruntled affiliate. This security breach fractured the organization from within.

Recognizing an opportunity to permanently dismantle the syndicate, the United States Department of State escalated its pressure campaign in May 2022. The U.S. government issued a staggering $15 million reward offer for information leading to the identification or location of key Conti leadership figures and co-conspirators. This financial bounty, combined with severe international sanctions and heightened law enforcement scrutiny, forced Conti into a strategic retreat and rapid structural dissolution.

Rather than disappearing, however, the human capital, malware variants, and operational infrastructure of Conti simply dispersed. By mid-summer, researchers began tracking the emergence of these splinter elements, noting that the threat landscape was rapidly evolving rather than shrinking.

Supporting Data: The Rise of Hiveleaks and BlackBasta

While Lockbit commands the highest volume of attacks, the most striking statistical anomalies in the July data center around two specific groups: Hiveleaks and BlackBasta. These syndicates have directly absorbed the operational vacuum left by Conti’s collapse.

NCC Group’s telemetry indicates that Hiveleaks surged to second place globally in July, launching 27 attacks. This figure represents an astronomical 440 percent increase compared to June activity. Close behind is BlackBasta, which secured third place with 24 attacks, representing a notable 50 percent month-over-month rise.

Security analysts have drawn direct operational and genealogical ties between these two groups and the defunct Conti enterprise. According to threat intelligence assessments, Hiveleaks operates as a prominent affiliate utilizing established distribution networks, while BlackBasta has effectively emerged as a direct replacement strain utilizing refined versions of Conti’s original codebase and extortion methodology.

When combined, these offshoots demonstrate that the shadow of Conti continues to loom large over global cybersecurity. The rapid transition of Conti members into these new operational identities underscores the inherent resilience of modern cybercriminal ecosystems, where organizations can dissolve under government pressure only to reform under different monikers within weeks.

Official Responses and Law Enforcement Perspectives

Law enforcement agencies, intelligence apparatuses, and private cybersecurity contractors have responded to this shifting paradigm with increased cross-border cooperation and proactive disruption strategies.

Following the U.S. State Department’s multi-million-dollar bounty announcement, international cyber-task forces have ramped up efforts to trace cryptocurrency wallets, dismantle infrastructure, and issue urgent advisories to vulnerable sectors. Agencies such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and the United Kingdom’s National Cyber Security Centre (NCSC) have repeatedly warned organizations against complacency, particularly regarding the dangers posed by RaaS models like Lockbit 3.0.

In official statements accompanying recent threat intelligence briefings, security researchers have stressed that law enforcement actions, while effective at fracturing monolithic groups like Conti, often produce unintended secondary effects. By dispersing experienced threat actors into smaller, highly agile cells, enforcement pressure can inadvertently catalyze a wider distribution of cyber threats across multiple fronts.

"It is likely that the threat actors that were undergoing structural changes have begun settling into their new modes of operating," noted authors of the NCC Group threat report. "As such, it appears that it has not taken long for Conti’s presence to filter back into the threat landscape, albeit under a new identity."

Broader Impact and Enterprise Implications

The implications of this mid-summer ransomware resurgence extend far beyond statistical fluctuations. For corporate boards, Chief Information Security Officers (CISOs), and IT administrators, the data serves as a stark reminder that the threat environment remains dynamic, persistent, and increasingly professionalized.

The dominance of Lockbit 3.0 highlights the dangers of the RaaS business model, wherein core developers lease their malicious software to independent affiliates in exchange for a percentage of the ransom. This modular approach allows cybercrime groups to scale their operations rapidly, targeting a diverse array of industries—including manufacturing, legal services, retail, and education—without needing to manage every phase of the attack lifecycle themselves.

Furthermore, the integration of former Conti personnel into groups like Hiveleaks and BlackBasta means that victims are facing adversaries with years of sophisticated penetration testing experience, advanced lateral movement capabilities, and highly refined social engineering tactics.

Security experts advise organizations to pivot away from traditional perimeter-based security measures and instead adopt a comprehensive, zero-trust architecture. Essential defensive postures include:

• Implementing robust, immutable offline backups to mitigate the leverage of data-encryption tactics.
• Enforcing multi-factor authentication (MFA) across all corporate networks and remote access points.
• Conducting regular vulnerability assessments and rapid patch management protocols.
• Establishing proactive threat-hunting programs to detect anomalous network behavior before catastrophic encryption events occur.

Outlook and Future Trajectory

As the cyber security community looks toward the remainder of the year, industry analysts warn that the upward trajectory observed in July is unlikely to abate soon. With Conti’s former components successfully reorganized into autonomous, highly productive factions, and with Lockbit showing no signs of slowing its relentless campaign cadence, the baseline volume of global ransomware attacks is expected to remain elevated.

"Now that Conti’s assets and operators have properly split and adapted into new structures, it would not be surprising to see these figures further increase," researchers cautioned. For organizations worldwide, maintaining constant vigilance, sharing actionable threat intelligence, and hardening digital infrastructure remain the primary defenses against an increasingly adaptive and resilient criminal underworld.