Lockbit Reigns Supreme as Global Ransomware Attacks Surge in July Driven by Conti Offshoots

The global cybersecurity landscape experienced a sharp and alarming resurgence in extortion operations throughout July, according to newly released threat intelligence data. Following a temporary dip in activity earlier in the summer, malicious cyber campaigns rebounded significantly, propelled primarily by established Ransomware-as-a-Service (RaaS) operations and splinter cells of recently fractured cybercrime syndicates. Industry analysts and threat researchers have identified the Lockbit gang as the undisputed leader in volume, while aggressive offshoots of the infamous Conti group have rapidly accelerated their operations to capture significant market share in the illicit underground economy.

According to comprehensive monthly monitoring reports published by the NCC Group, threat intelligence researchers recorded a total of 198 successful ransomware attacks globally in July. This figure represents a striking 47 percent increase compared to June, signaling that threat actors have successfully regrouped, retooled, and scaled their infrastructure following a series of international law enforcement disruptions in the spring. While the July figures remain below the peak activity levels observed in March and April—during which nearly 300 successful campaigns were logged per month—the sudden upward trajectory has alarmed cybersecurity professionals and enterprise risk managers alike.

The mechanics of this monitoring rely heavily on active digital surveillance. Researchers continually track and scrape extortion leak sites operated by various ransomware gangs, logging victim identities, corporate data leaks, and ransom demands the moment they are published. This rigorous data collection methodology provides a reliable barometer of the shifting threat landscape, illuminating which criminal enterprises are expanding their operational capacity and which are fading into obscurity.

Lockbit Solidifies Dominance with Lockbit 3.0

At the epicenter of July’s surge is the Lockbit syndicate, which has cemented its status as the most prolific and dangerous ransomware operation operating in the wild today. In July alone, Lockbit was responsible for 62 confirmed attacks, marking an increase of ten incidents compared to the previous month. This staggering volume places Lockbit far ahead of its nearest competitors, nearly doubling the combined attack output of the second and third most prolific syndicates.

The group’s latest iteration, operating under the moniker Lockbit 3.0 (also known as Lockbit Black), has successfully maintained a dominant foothold across multiple industry sectors globally. Security analysts note that Lockbit 3.0 has refined its affiliate program, offering higher payouts to skilled intrusion brokers and deploying advanced evasion techniques that bypass traditional endpoint detection and response (EDR) agents. The group’s aggressive recruitment strategies, coupled with a robust leak site infrastructure, ensure a steady pipeline of corporate compromises.

Cybersecurity experts emphasize that Lockbit’s persistent dominance is no accident. The organization functions with corporate-like efficiency, complete with dedicated customer service portals for negotiating extortions, public relations channels, and bug bounty programs designed to harden their malicious codebases against academic and law enforcement scrutiny. Consequently, security agencies and corporate boards increasingly view Lockbit as a Tier-1 operational risk requiring specialized defense strategies, continuous threat intelligence monitoring, and multi-layered defense-in-depth architectures.

The Resurgence and Metamorphosis of the Conti Syndicate

While Lockbit claimed the highest volume of individual attacks, the most profound structural shift in the July threat data involved the descendants of the Conti ransomware group. Conti, historically operated out of Russian-speaking jurisdictions and recognized as the world’s most formidable cybercrime cartel, formally ceased centralized operations earlier in the year following internal ideological fractures and devastating operational leaks.

However, the dissolution of Conti did not equate to the disbandment of its skilled operators. Instead, the collective splintered into various autonomous cells, affiliates, and offshoots. Two of these emergent entities—Hiveleaks and BlackBasta—surged dramatically in July, dominating the upper echelons of the global ransomware rankings and fueling the broader market resurgence.

Hiveleaks, utilizing the Hive ransomware variant, surged into the second-most prolific position in July with 27 recorded attacks. This represents a staggering 440 percent increase in activity compared to June. Simultaneously, BlackBasta—a relative newcomer that emerged earlier in the spring—claimed third place with 24 attacks, representing a 50 percent month-over-month increase.

Threat intelligence analysts have established direct operational and personnel overlaps between these groups and the legacy Conti infrastructure. Hiveleaks has historically operated as a high-profile affiliate within the Conti ecosystem, while BlackBasta has widely been observed utilizing similar tactics, techniques, and procedures (TTPs), as well as codebases that bear striking similarities to Conti’s proprietary tools. The rapid ascension of these two groups demonstrates that the institutional knowledge, technical expertise, and initial access broker networks established by Conti have successfully filtered back into the active threat landscape under new brand identities.

Chronology of Regulatory Pressure and Criminal Adaptation

To understand the current resurgence of ransomware, it is essential to examine the regulatory and geopolitical chronology that preceded it. The first half of 2022 was characterized by intense, coordinated pressure from Western governments—led primarily by the United States—aimed at dismantling Russian-aligned cybercrime syndicates.

In May, the United States Department of State escalated its offensive against the Conti organization by issuing a reward of up to $15 million under the Transnational Organized Crime Rewards Program. This financial bounty sought actionable information leading to the identification and localization of key Conti leadership figures, as well as co-conspirators involved in specific variant attacks against critical infrastructure.

This unprecedented financial pressure, compounded by internal dissent regarding the group’s public alignment with the Russian government’s geopolitical actions in Ukraine, precipitated the structural collapse of Conti. Main servers were wiped, internal chat logs were leaked by disgruntled insiders, and the monolithic organization dissolved into decentralized cell structures.

During May and June, these displaced cybercriminals underwent a transitional phase. They restructured their management hierarchies, rebranded their extortion portals, and established new financial laundering pathways utilizing privacy-centric cryptocurrencies. The July data release from NCC Group provides the first concrete quantitative evidence that this operational restructuring phase has concluded. Having settled into their new modes of operation, these threat actors have ramped up their deployment velocity, directly driving the 47 percent month-over-month increase in global attacks.

Quantitative Overview of the Threat Landscape

A detailed breakdown of the July 2022 threat intelligence data underscores the heavy concentration of risk within a small handful of threat groups. Out of the 198 total successful incidents recorded:

• Lockbit accounted for approximately 31.3 percent of all documented attacks, solidifying its role as the industry leader in extortion volume.
• Hiveleaks represented roughly 13.6 percent of attacks, showing explosive month-over-month growth.
• BlackBasta captured roughly 12.1 percent of the market share, establishing itself as a premier enterprise-targeting ransomware strain.

Together, these top three syndicates accounted for more than half of all recorded ransomware events globally during the month. The remaining incidents were distributed among dozens of smaller, opportunistic, or emerging RaaS operations, including Alphv (BlackCat), Karakurt, and Vice Society.

Geographically and sector-wise, the targeting methodology remained consistent with historical patterns. Manufacturing, industrial goods, professional services, healthcare, and retail sectors bore the brunt of the compromise volume. Organizations located in North America and Western Europe remained the primary targets of choice, largely due to the higher propensity of victim organizations in these regions possessing cyber insurance policies and the financial liquidity required to meet steep multi-million-dollar ransom demands.

Official Responses and Law Enforcement Perspectives

Law enforcement agencies, national cybersecurity centers, and international task forces have responded to the shifting threat environment with enhanced cross-border cooperation and public-private partnerships. Agencies such as the U.S. Cybersecurity and Infrastructure Security Agency (CISA), the Federal Bureau of Investigation (FBI), and Europol have continually issued joint advisories warning enterprise networks of the tactics employed by Lockbit 3.0 and Conti-associated splinter groups.

Government officials emphasize that traditional perimeter defenses are no longer sufficient to deter sophisticated RaaS operations. Modern ransomware campaigns rarely rely on simplistic phishing vectors alone; instead, threat actors frequently exploit unpatched edge devices, utilize stolen or compromised valid credentials purchased from initial access brokers, and abuse legitimate administrative tools—a technique known as "living off the land"—to maintain persistence within victim networks before deploying encryption payloads.

In response to the proliferation of Conti offshoots, law enforcement has intensified financial tracking operations, targeting cryptocurrency mixing services and over-the-counter (OTC) brokers used by criminal syndicates to launder ransom payments. Regulatory bodies have also tightened compliance standards for cyber insurance providers, discouraging the indiscriminate payout of ransoms and encouraging mandatory incident reporting.

Broader Business Implications and Risk Analysis

The implications of the July threat data for the broader corporate ecosystem are profound. The rapid recovery and expansion of ransomware operations following significant law enforcement disruptions demonstrate the remarkable resilience and adaptability of modern cybercrime economics. As long as initial network compromises remain lucrative, threat actors will continue to adapt their organizational structures to evade geopolitical pressure.

Industry analysts warn that as these fragmented Conti groups—specifically Hiveleaks and BlackBasta—fully normalize their operations alongside the dominant Lockbit infrastructure, successful attack volumes are likely to climb further as autumn approaches. Organizations are urged to move beyond basic compliance frameworks and adopt proactive threat-hunting postures.

Key strategic recommendations derived from current threat intelligence include:

• Implementing rigorous multi-factor authentication (MFA) resistant to phishing and session-hijacking techniques.
• Conducting continuous vulnerability assessments, with priority given to rapid patching of internet-facing assets and known exploited vulnerabilities.
• Establishing immutable, offline backups protected by strict access controls to ensure operational recovery without capitulating to extortion demands.
• Enhancing network segmentation to prevent lateral movement in the event of an initial endpoint compromise.

As the cybersecurity community navigates the remainder of the year, the data serves as a stark reminder that the war against ransomware is an ongoing, dynamic conflict. The evolution of Lockbit 3.0 and the rebirth of Conti under new banners illustrate that while individual gang names may shift or fade, the underlying criminal infrastructure remains highly adaptable, requiring constant vigilance, technological innovation, and international cooperation to contain.