Ransomware Attacks are on the Rise
Ransomware attacks have increased recently, with the Lockbit group leading in activity during the summer of 2022. Two offshoots of the Conti ransomware group, Hiveleaks and BlackBasta, have also seen significant rises in attacks. This resurgence follows a period of disruption after U.S. government actions against Conti. The threat landscape is evolving as these groups restructure and continue operations under new identities.
AI Analysis
Technical Summary
According to data from NCC Group and reported by Threatpost, ransomware attacks surged in July 2022, led by Lockbit with 62 attacks, followed by Hiveleaks and BlackBasta, both linked to the former Conti group. The rise in attacks corresponds with structural changes in ransomware groups after U.S. government efforts targeted Conti in May 2022. Hiveleaks operates as an affiliate, and BlackBasta as a replacement strain of Conti, indicating the group's continued influence under new names. The total number of ransomware campaigns in July was 198, a 47% increase from June, though still below the peak in March and April. This data was gathered by monitoring ransomware leak sites and victim disclosures.
Potential Impact
The increase in ransomware campaigns represents a heightened threat to organizations globally, with Lockbit and Conti-associated groups being particularly active. The restructuring of Conti into Hiveleaks and BlackBasta suggests ongoing operational capabilities and potential for further attacks. This trend indicates persistent ransomware risks that could lead to data encryption, extortion, and operational disruption for victims.
Mitigation Recommendations
No specific patch or remediation is applicable as this is a threat actor activity report rather than a software vulnerability. Organizations should remain vigilant and maintain robust ransomware defenses. The report does not indicate any 'no action required' status or official fixes related to this threat. Monitoring threat intelligence sources and applying best practices against ransomware remain prudent.
Ransomware Attacks are on the Rise
Description
Ransomware attacks have increased recently, with the Lockbit group leading in activity during the summer of 2022. Two offshoots of the Conti ransomware group, Hiveleaks and BlackBasta, have also seen significant rises in attacks. This resurgence follows a period of disruption after U.S. government actions against Conti. The threat landscape is evolving as these groups restructure and continue operations under new identities.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
According to data from NCC Group and reported by Threatpost, ransomware attacks surged in July 2022, led by Lockbit with 62 attacks, followed by Hiveleaks and BlackBasta, both linked to the former Conti group. The rise in attacks corresponds with structural changes in ransomware groups after U.S. government efforts targeted Conti in May 2022. Hiveleaks operates as an affiliate, and BlackBasta as a replacement strain of Conti, indicating the group's continued influence under new names. The total number of ransomware campaigns in July was 198, a 47% increase from June, though still below the peak in March and April. This data was gathered by monitoring ransomware leak sites and victim disclosures.
Potential Impact
The increase in ransomware campaigns represents a heightened threat to organizations globally, with Lockbit and Conti-associated groups being particularly active. The restructuring of Conti into Hiveleaks and BlackBasta suggests ongoing operational capabilities and potential for further attacks. This trend indicates persistent ransomware risks that could lead to data encryption, extortion, and operational disruption for victims.
Defensive Guidance
No specific patch or remediation is applicable as this is a threat actor activity report rather than a software vulnerability. Organizations should remain vigilant and maintain robust ransomware defenses. The report does not indicate any 'no action required' status or official fixes related to this threat. Monitoring threat intelligence sources and applying best practices against ransomware remain prudent.
Technical Details
- Classification
- {"confidence":0.71,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://threatpost.com/ransomware-attacks-are-on-the-rise/180481/","fetched":true,"fetchedAt":"2026-08-04T12:41:22.186Z","wordCount":673}
Threat ID: 6a71ddf3bf8831d539cc9784
Added to database: 08/04/2026, 12:41:23 UTC
Last enriched: 08/04/2026, 12:42:30 UTC
Last updated: 08/04/2026, 13:06:23 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.