Ransomware attacks are back on the rise after a brief dip, with NCC Group recording 198 successful campaigns in July — a 47% increase from June.
LockBit dominated the month with 62 attacks, more than twice as many as the next two groups combined. HiveLeaks came in second with 27 attacks (a 440% jump from June), and BlackBasta took third with 24 (up 50%).
The resurgence appears linked to the restructuring of Conti, once the world’s most prolific ransomware gang. After the US government offered up to $15 million for information about Conti in May, the group split. HiveLeaks emerged as a Conti affiliate, while BlackBasta is considered a replacement strain.
“It has not taken long for Conti’s presence to filter back into the threat landscape, albeit under a new identity,” researchers noted. The numbers still fall short of the spring peak of nearly 300 campaigns in March and April, but the upward trend is clear.
Organizations should prioritize offline backups, network segmentation, and prompt patching of internet-facing systems. Ransomware groups continue to favor double-extortion tactics, stealing data before encrypting it.
