Lockbit has come back out of the shadows as the most prominent ransomware group through its activities in May, new research from NCC Group shows.

Lockbit, which fell silent after a coordinated operation by global law enforcement organisations, called Operation Cronos, disabled the gang’s key infrastructure in February 20234.

In May, Lockbit 3.0 returned to the scene with 176 ransomware attacks, accounting for 37% of the month’s total.

May marks a prolific return for the ransomware gang, marking a 665% increase in attacks from last month.

After the crackdown, a LockBit admin admitted negligence in a message, but also insisted that they would be back in action and would create a new leak site.

The resurgence suggests that LockBit did not fully dissolve after the law enforcement operation, and was potentially able to retain some of the talent that drove its ransomware-as-a-service scheme to dominant the landscape.

Besides LockBit, new groups were found to entre the top ten threat actor list last month.

Dan0n, which was first noticed in April this year, had 13 attacks, putting it in eighth place. Arcus Media, a new threat group, came in tenth with 11 attacks.

The NCC Group’s data found that ransomware attacks rose by 32% month-on-month across the globe, with an 8% year-on-year rise.

Recommended reading

• • LockBit Ransomware Group Leader Exposed
  • Lockbit Tries to Relaunch Following Global Police Takedown
  • LockBit 3.0 Dethroned and New Players are Emerging

According to the report, technology was the second most targeted industry, which saw a 47% month on month rise from 49 to 72 attacks.

Industrials, however, was the most targeted industry, with 143 attacks, totally 30% of May’s attacks.

Attacks in Europe were also on the rise, growing by 65%, while North American figures decreased from 58% to 49%.