Conti vs. LockBit: A Comparative Analysis of Ransomware Groups<\/title> <link href=\"https:\/\/fonts.googleapis.com\/css?family=Open+Sans:300,300i,400,400i,600\" rel=\"stylesheet\">\n<link href=\"\/\/customer.cludo.com\/css\/296\/1798\/cludo-search.min.css\" type=\"text\/css\" rel=\"stylesheet\"> <link rel=\"stylesheet\" href=\"\/etc.clientlibs\/trendresearch\/clientlibs\/clientlib-trendresearch.min.css\" type=\"text\/css\"> <meta property=\"og:url\" content=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.html\"><br \/>\n<meta property=\"og:title\" content=\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups\"><br \/>\n<meta property=\"og:description\" content=\"We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022.\"><br \/>\n<meta property=\"og:site_name\" content=\"Trend Micro\"><br \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/cover-conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.jpg\"><br \/>\n<meta property=\"og:locale\" content=\"en_US\"> <meta name=\"twitter:card\" content=\"summary_large_image\"><br \/>\n<meta name=\"twitter:site\" content=\"@TrendMicro\"><br \/>\n<meta name=\"twitter:title\" content=\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups\"><br \/>\n<meta name=\"twitter:description\" content=\"We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022.\"><br \/>\n<meta name=\"twitter:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/cover-conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.jpg\"> <\/head> <body class=\"articlepage page basicpage context-business\" id=\"readabilityBody\" readability=\"50.027232096456\">  <a id=\"page-scroll\" title=\"VerticalPageScroll\" href=\"javascript:jumpScroll($(this).scrollTop());\"> <span class=\"icon-chevron-up\"><\/span> <\/a>  <\/p>\n<div class=\"root responsivegrid\">\n<div class=\"aem-Grid aem-Grid--12 aem-Grid--default--12 \">\n<div class=\"articleBodyNoHero aem-GridColumn aem-GridColumn--default--12\">\n<div class=\"research-layout article container\" role=\"contentinfo\">\n<article class=\"research-layout--wrapper row\" data-article-pageid=\"1054812828\">\n<div class=\"col-xs-12 col-md-12 one-column\">\n<div class=\"col-xs-12 col-md-12\" readability=\"9.7727272727273\">\n<div class=\"article-details\" role=\"heading\" readability=\"39.090909090909\"> <span class=\"article-details__bar\" role=\"img\"><\/span> <\/p>\n<p class=\"article-details__display-tag\">Ransomware<\/p>\n<p class=\"article-details__description\">We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022.<\/p>\n<p class=\"article-details__author-by\">By: Shingo Matsugaya, Matsukawa Bakuei, Vladimir Kropotov <time class=\"article-details__date\">June 27, 2022<\/time> <span>Read time: <\/span><span class=\"eta\"><\/span> (<span class=\"words\"><\/span> words) <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<hr class=\"research-layout-divider\"> <main class=\"main--content col-xs-12 col-md-8 col-md-push-2\"> <\/p>\n<div class=\"richText\" readability=\"34.631199278629\">\n<div readability=\"17.783588818756\">\n<p>Trend Micro has been monitoring the leak sites of multiple <a href=\"https:\/\/www.trendmicro.com\/vinfo\/tmr\/?\/us\/security\/definition\/ransomware\">ransomware<\/a> groups since November 2019 and continuously looking at the number and composition of organizations that have been victimized and whose information has been publicized by these groups. As a result of our research thus far, <a href=\"https:\/\/www.trendmicro.com\/vinfo\/tmr\/?\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-conti\">Conti<\/a> and <a href=\"https:\/\/www.trendmicro.com\/vinfo\/tmr\/?\/us\/security\/news\/ransomware-spotlight\/ransomware-spotlight-lockbit\">LockBit<\/a> stand out in terms of their total numbers of affected organizations. Our goal with our research is to show how applying data analysis approaches to this data can give powerful understanding on the operations and perhaps even decision-making of these cybercriminals groups \u2014 a topic we will also be presenting on this week at <a href=\"https:\/\/www.first.org\/conference\/2022\/program#pRaaS-Ransomware-as-a-Science-Chan-eil-tuil-air-nach-tig-traoghadh\">the 34th Annual FIRST Conference in Dublin<\/a>, with colleagues from Waratah Analytics. While some reports indicate the Conti brand is now <a href=\"https:\/\/www.advintel.io\/post\/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape\">offline<\/a>, its scale continues to make it an excellent case study for these approaches.<\/p>\n<p>When we rank the top 10 ransomware groups in terms of the number of organizations that had their data leaked (from November 2019 to March 2022), we see two clear leaders. In fact, Conti and Lockbit between them account for almost 45% of all incidents.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div>\n<div class=\"richText\">\n<div class=\"responsive-table-wrap\">\n<table cellpadding=\"1\" cellspacing=\"0\" border=\"1\">\n<tbody>\n<tr>\n<td>Rank<\/td>\n<td>Ransomware group<\/td>\n<td>Victim count<\/td>\n<\/tr>\n<tr>\n<td>1<\/td>\n<td>Conti<\/td>\n<td>805<\/td>\n<\/tr>\n<tr>\n<td>2<\/td>\n<td>Lockbit<\/td>\n<td>666<\/td>\n<\/tr>\n<tr>\n<td>3<\/td>\n<td>Maze<\/td>\n<td>330<\/td>\n<\/tr>\n<tr>\n<td>4<\/td>\n<td>REvil\/Sodinokibi<\/td>\n<td>309<\/td>\n<\/tr>\n<tr>\n<td>5<\/td>\n<td>Pysa<\/td>\n<td>307<\/td>\n<\/tr>\n<tr>\n<td>6<\/td>\n<td>DoppelPaymer<\/td>\n<td>206<\/td>\n<\/tr>\n<tr>\n<td>7<\/td>\n<td>Egregor<\/td>\n<td>197<\/td>\n<\/tr>\n<tr>\n<td>8<\/td>\n<td>Avaddon<\/td>\n<td>184<\/td>\n<\/tr>\n<tr>\n<td>9<\/td>\n<td>NetWalker<\/td>\n<td>178<\/td>\n<\/tr>\n<tr>\n<td>10<\/td>\n<td>Clop<\/td>\n<td>119<\/td>\n<\/tr>\n<\/tbody>\n<\/table><\/div>\n<\/p><\/div>\n<div class=\"richText\" readability=\"31.5\">\n<div readability=\"8\">\n<p>Table 1. The top 10 ransomware groups in terms of the number of victimized organizations from November 2019 to March 2022<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"richText\" readability=\"33.5\">\n<div readability=\"12\">\n<p>Here, by comparative analysis of the characteristics of the organizations victimized by these two major ransomware groups, we clarify their differences in attack tendencies. <\/p>\n<p><span class=\"body-subhead-title\">Number of victimized organizations per month<\/span><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure1.png\" alt=\"fig1-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 1. The monthly and cumulative numbers of organizations victimized by Conti and LockBit from August 2020 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"39.969273743017\">\n<div readability=\"26.321229050279\">\n<p>Since August 2020, there has been a large, stable number of organizations victimized by Conti, albeit with monthly increases and decreases. We have observed LockBit since September 2020, but the number of organizations victimized by the group per month has been very small, between one and three only. In addition, since January 2021, its original leak sites have been suspended and no victimized organizations have been reported. However, since its resumption of activity in July 2021, with the so-called <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/h\/lockbit-resurfaces-with-version-2-0-ransomware-detections-in-chi.html\">LockBit 2.0<\/a>, its number of victimized organizations has exceeded Conti\u2019s, making it the most active ransomware group. As a result, LockBit has been rapidly catching up in terms of the total number of victimized organizations, and as of March 2022, we have predicted that it will overtake Conti around August 2022 to become the largest ransomware group in terms of the total number of victimized organizations. However, with Conti likely <a href=\"https:\/\/www.advintel.io\/post\/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape\">having shut down<\/a> in May 2022, or at least rebranding, it is almost certain that LockBit will overtake Conti sooner than expected.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure2.png\" alt=\"fig2-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 2. A predictive trend of Conti and Lockbit\u2019s future crossover point considering the numbers of organizations victimized by the two ransomware groups from July 2021 to March 2022 (prior to Conti\u2019s shutdown)<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"31\">\n<div readability=\"7\">\n<p><span class=\"body-subhead-title\">Victimized organizations by region<\/span><\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure3.png\" alt=\"fig3-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 3. The regional distribution of organizations victimized by Conti (left) and LockBit (right) from November 2019 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"38.099633251834\">\n<div readability=\"23.149144254279\">\n<p>Looking at the regions where their victimized organizations are located, we see that there is a big difference between Conti and LockBit. For Conti, 93% of its victims are in North America and Europe, very much concentrated in these two regions. By comparison, 68% of LockBit\u2019s victims are in the same two regions. On the other hand, the areas of the victimized organizations are more dispersed for LockBit. We have observed many victimized organizations in Asia-Pacific, South\/Latin America, and the Middle East, among others.<\/p>\n<p>Comparing the regional distribution of organizations victimized by Conti and LockBit with <a href=\"https:\/\/en.wikipedia.org\/wiki\/List_of_countries_by_GDP_(nominal)\">the regional GDP distribution<\/a>, LockBit is closer to the regional GDP distribution except for Asia-Pacific. Therefore, LockBit seems to be attacking specific regions more indiscriminately than Conti.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure4.png\" alt=\"fig4-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 4. The regional distribution of organizations victimized by Conti (left) and LockBit (middle) from November 2019 to March 2022, and of GDP (right) as of March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"35\">\n<div readability=\"15\">\n<p>A closer look at the countries and regions of the victimized organizations in Asia-Pacific reveals that Conti has many victimized organizations in English-speaking countries such as Australia, India, New Zealand, and Singapore. LockBit\u2019s, on the other hand, are again more distributed in various countries.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure5.png\" alt=\"fig5-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 5. The distribution by country or region of organizations victimized by Conti (left) and LockBit (right) in Asia-Pacific from November 2019 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"35.5\">\n<div readability=\"16\">\n<p>Considering that the number of victimized organizations in Asia-Pacific is small for both Conti and LockBit compared to the GDP of the region, this suggests that local languages or alphabets might have been a barrier to these groups in attacking countries there, as in searching for confidential information to steal in an organization\u2019s network.<\/p>\n<p>Looking at changes in the distribution of victimized organizations over time in a simple moving average, we see that Conti\u2019s attacks on organizations in Europe are on the rise. <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure6.png\" alt=\"fig6-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 6. A simple moving average of the number of organizations victimized by Conti in each region from November 2020 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"32.5\">\n<div readability=\"10\">\n<p>In addition, closely looking at the regions other than the top two regions, we see that Conti\u2019s attacks on organizations in Asia-Pacific have been gradually increasing.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure7.png\" alt=\"fig7-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 7. A simple moving average of the number of organizations victimized by Conti in each region, except North America and Europe, from November 2020 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"32\">\n<div readability=\"9\">\n<p>LockBit has also seen a slight increase in its attacks on organizations in Europe, but its distribution in each region has remained largely stable.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure8.png\" alt=\"fig8-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 8. A simple moving average of the number of organizations victimized by LockBit in each region from November 2021 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"34.5\">\n<div readability=\"14\">\n<p><span class=\"body-subhead-title\">Victimized organizations by industry<\/span><\/p>\n<p>Looking at the number of victimized organizations by industry, we see that both Conti and LockBit are distributed almost evenly across various industries (the top 15 industries are the same and in the same order), and it seems that there is no difference in their attack tendencies against industries. This indicates that they are not targeting specific industries.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure9.png\" alt=\"fig9-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 9. The distribution by industry of organizations victimized by Conti (left) and LockBit (right) from November 2019 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"32\">\n<div readability=\"9\">\n<p>Looking at the number of victimized organizations by number of employees, we see LockBit has victimized more small organizations than Conti. <\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure10.png\" alt=\"fig10-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 10. The distribution by number of employees of organizations victimized by Conti (left) and LockBit (right) from November 2019 to March 2022<\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"33.5\">\n<div readability=\"12\">\n<p>Also, looking at the monthly number of changes in the moving average, LockBit has a stable ratio by number of employees, whereas Conti comparatively has a lot of variability and its attack tendency is not very stable.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure11_Conti.png\" alt=\"fig11-A-conti-vs-lockbit-comparative-analysis\"> <\/figure>\n<\/p><\/div>\n<div class=\"image\">\n<figure class=\"image-figure\"> <img decoding=\"async\" src=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/Figure11_LockBit.png\" alt=\"fig11-B-conti-vs-lockbit-comparative-analysis\"><figcaption>Figure 11. A simple moving average of the number of organizations victimized by Conti (top) from November 2020 to March 2022 and by LockBit (bottom) from November 2021 to March 2022 in each organization size in terms of number of employees <\/figcaption><\/figure>\n<\/p><\/div>\n<div class=\"richText\" readability=\"42.155844155844\">\n<div readability=\"33.907961603614\">\n<p><span class=\"body-subhead-title\">Conclusion<\/span><\/p>\n<p>These characteristics visible from the data can be examined in greater depth by matching them with information provided by different threat intelligence sources. Conti, for example, has vowed <a href=\"https:\/\/www.trellix.com\/en-au\/about\/newsroom\/stories\/threat-labs\/conti-leaks-examining-the-panama-papers-of-ransomware.html\">not to target Russia\u2019s allies<\/a>, such as former Soviet Union countries and China. It has also been reported that Conti prefers to <a href=\"https:\/\/krebsonsecurity.com\/2022\/03\/conti-ransomware-group-diaries-part-iii-weaponry\">target large organizations<\/a> with more revenue and therefore more money to spare to earn more ransom.<\/p>\n<p>LockBit, for its part, has stated that it <a href=\"https:\/\/www.youtube.com\/watch?v=ldgmx4ZCfFg\">selects<\/a> <a href=\"https:\/\/flashpoint.io\/blog\/what-does-lockbit-want-decrypting-an-interview-with-the-ransomware-collective\">targets<\/a> only for financial motives without being influenced by political ties. It has also stated that <a href=\"https:\/\/www.volkskrant.nl\/nieuws-achtergrond\/hij-verdient-miljoenen-met-gijzelsoftware-we-vallen-iedereen-aan-die-we-kunnen-pakken~ba32b8a8\">its ringleader resides in Hong Kong<\/a>. Since targeting an organization in one\u2019s country or region of residence increases the risk of being investigated and arrested by the local police, it is practically a given that organizations in the country or region of residence should not be targeted from the viewpoint of the security of the attacker.<\/p>\n<p>By applying data analysis approaches such as what we present here to other ransomware groups, and cross-checking the information from different threat intelligence sources with data leaks, it is possible to deeply analyze each group\u2019s characteristics. Furthermore, it is possible to gain deep insight into an attacker\u2019s targeting and business model and to quickly notice changes in the attacker\u2019s trends. This data, both current and predictive, can be invaluable for a range of people including network defenders looking to know where to invest for their security, insurers looking to understand risk, and law enforcement.<\/p>\n<p>More details and approaches about ransomware data analysis will be presented at <a href=\"https:\/\/www.first.org\/conference\/2022\/program#pRaaS-Ransomware-as-a-Science-Chan-eil-tuil-air-nach-tig-traoghadh\">the 34th Annual FIRST Conference in Dublin<\/a> on June 27 by Vladimir Kropotov of Trend Micro and Eireann Leverett of Waratah Analytics.<\/p>\n<\/p><\/div>\n<\/p><\/div>\n<\/p><\/div>\n<section class=\"tag--list\">\n<p>Tags<\/p>\n<\/section>\n<p> <\/main> <\/article>\n<\/div>\n<\/div><\/div>\n<\/div>\n<p>   <\/p>\n<p> <span>sXpIBdPeKzI9PC2p0SWMpUSM2NSxWzPyXTMLlbXmYa0R20xk<\/span> <\/p>\n<p>   <\/body> Read More <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>We compare the targeting and business models of the Conti and LockBit ransomware groups using data analysis approaches. This will be presented in full at the 34th Annual FIRST Conference on June 27, 2022. Read More HERE…<\/p>\n","protected":false},"author":2,"featured_media":47275,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[61],"tags":[9510,9521,9511,9508,9513,9539,9509],"class_list":["post-47274","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-trendmicro","tag-trend-micro-research-articles-news-reports","tag-trend-micro-research-cyber-crime","tag-trend-micro-research-cyber-threats","tag-trend-micro-research-endpoints","tag-trend-micro-research-malware","tag-trend-micro-research-ransomware","tag-trend-micro-research-research"],"yoast_head":"\n<title>Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-06-27T00:00:00+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/cover-conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.jpg\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"7 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups\",\"datePublished\":\"2022-06-27T00:00:00+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/\"},\"wordCount\":1439,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png\",\"keywords\":[\"Trend Micro Research : Articles, News, Reports\",\"Trend Micro Research : Cyber Crime\",\"Trend Micro Research : Cyber Threats\",\"Trend Micro Research : Endpoints\",\"Trend Micro Research : Malware\",\"Trend Micro Research : Ransomware\",\"Trend Micro Research : Research\"],\"articleSection\":[\"TrendMicro\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/\",\"name\":\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png\",\"datePublished\":\"2022-06-27T00:00:00+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2022\\\/06\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png\",\"width\":2998,\"height\":872},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Trend Micro Research : Articles, News, Reports\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/trend-micro-research-articles-news-reports\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n","yoast_head_json":{"title":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/","og_locale":"en_US","og_type":"article","og_title":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-06-27T00:00:00+00:00","og_image":[{"url":"https:\/\/www.trendmicro.com\/content\/dam\/trendmicro\/global\/en\/research\/22\/f\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/cover-conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.jpg","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"7 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups","datePublished":"2022-06-27T00:00:00+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/"},"wordCount":1439,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/06\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png","keywords":["Trend Micro Research : Articles, News, Reports","Trend Micro Research : Cyber Crime","Trend Micro Research : Cyber Threats","Trend Micro Research : Endpoints","Trend Micro Research : Malware","Trend Micro Research : Ransomware","Trend Micro Research : Research"],"articleSection":["TrendMicro"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/","url":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/","name":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#primaryimage"},"thumbnailUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/06\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png","datePublished":"2022-06-27T00:00:00+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#primaryimage","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/06\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2022\/06\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups.png","width":2998,"height":872},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Trend Micro Research : Articles, News, Reports","item":"https:\/\/www.threatshub.org\/blog\/tag\/trend-micro-research-articles-news-reports\/"},{"@type":"ListItem","position":3,"name":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/47274","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=47274"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/47274\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media\/47275"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=47274"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=47274"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=47274"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}

{"id":47274,"date":"2022-06-27T00:00:00","date_gmt":"2022-06-27T00:00:00","guid":{"rendered":"urn:uuid:43de7b72-8e0c-4de7-afb9-91b29d416f86"},"modified":"2022-06-27T00:00:00","modified_gmt":"2022-06-27T00:00:00","slug":"conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/conti-vs-lockbit-a-comparative-analysis-of-ransomware-groups\/","title":{"rendered":"Conti vs. LockBit: A Comparative Analysis of Ransomware Groups"},"content":{"rendered":"