What caused the ransomware attack surge in July?

Conti's breakup after US bounties birthed aggressive splinters like Hiveleaks and BlackBasta, plus LockBit's dominance—198 total campaigns, up 47%.

Which ransomware group is most active right now?

LockBit, with 62 attacks in July per NCC Group data. They're the undisputed champ, far ahead of the pack.

Likely yes—splinter groups are settling in, and history shows disruptions just spawn new threats. Expect 300+ by fall.

🛡️ Security Tools

Ransomware's not dead—it's thriving. LockBit just notched 62 hits in July, mocking last year's crackdowns.

Threat Digest Apr 03, 2026 3 min read 22 views

Published by

Threat intelligence. Zero noise.

#BlackBasta #Conti ransomware #Hiveleaks #LockBit #NCC Group #ransomware attacks

Get the best Cybersecurity stories of the week in your inbox — no noise, no spam.

Originally reported by Threatpost