Ransomware Prevention and Restoration Expertise Adelaide

Ransomware : Your Feared IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an enterprise-level threat for businesses vulnerable to an attack. Versions of ransomware like the Dharma, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict destruction. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, as well as frequent as yet unnamed malware, not only encrypt on-line data but also infiltrate any accessible system backup. Files replicated to off-site disaster recovery sites can also be encrypted. In a poorly designed environment, this can render any restoration hopeless and effectively knocks the datacenter back to zero.

Retrieving services and information after a ransomware attack becomes a race against the clock as the victim struggles to stop the spread and cleanup the virus and to restore mission-critical activity. Due to the fact that ransomware requires time to move laterally, penetrations are usually launched on weekends and holidays, when attacks are likely to take longer to detect. This compounds the difficulty of rapidly assembling and coordinating a knowledgeable response team.

Progent makes available an assortment of help services for securing Adelaide enterprises from ransomware penetrations. Among these are user education to help recognize and avoid phishing attempts, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat defense to detect and quarantine zero-day modern malware assaults. Progent in addition can provide the services of expert crypto-ransomware recovery professionals with the track record and perseverance to re-deploy a breached network as soon as possible.

Progent's Ransomware Recovery Services
Soon after a ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber criminals will return the codes to decipher any of your information. Kaspersky ascertained that 17% of crypto-ransomware victims never restored their files even after having sent off the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is significantly higher than the typical ransomware demands, which ZDNET estimated to be in the range of $13,000 for smaller businesses. The fallback is to setup from scratch the mission-critical elements of your IT environment. Without access to complete information backups, this requires a broad range of IT skills, professional project management, and the ability to work continuously until the job is finished.

For decades, Progent has made available professional IT services for businesses throughout the United States and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes professionals who have earned high-level industry certifications in important technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security specialists have garnered internationally-renowned industry certifications including CISA, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent in addition has experience with accounting and ERP software solutions. This breadth of experience affords Progent the skills to rapidly understand critical systems and organize the surviving parts of your Information Technology system following a ransomware event and assemble them into a functioning system.

Progent's security team uses best of breed project management systems to coordinate the complicated recovery process. Progent understands the importance of working quickly and in concert with a customer's management and IT resources to prioritize tasks and to get essential systems back online as soon as humanly possible.

Client Story: A Successful Ransomware Virus Recovery
A client hired Progent after their company was brought down by Ryuk ransomware. Ryuk is believed to have been developed by Northern Korean state sponsored hackers, suspected of using algorithms exposed from America's National Security Agency. Ryuk goes after specific companies with little tolerance for operational disruption and is among the most profitable instances of crypto-ransomware. High publicized organizations include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in Chicago with around 500 employees. The Ryuk event had shut down all essential operations and manufacturing processes. Most of the client's data backups had been online at the beginning of the attack and were destroyed. The client was taking steps for paying the ransom demand (more than $200,000) and praying for the best, but in the end utilized Progent.

Progent worked hand in hand the client to rapidly identify and prioritize the mission critical applications that had to be addressed in order to resume departmental functions:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

In less than 2 days, Progent was able to restore Active Directory to its pre-penetration state. Progent then accomplished setup and hard drive recovery of the most important systems. All Exchange schema and attributes were intact, which accelerated the restore of Exchange. Progent was able to find local OST data files (Outlook Email Offline Folder Files) on team PCs and laptops to recover email data. A recent off-line backup of the customer's accounting/MRP systems made them able to recover these vital programs back on-line. Although major work remained to recover totally from the Ryuk damage, critical services were returned to operations rapidly:

Throughout the next couple of weeks critical milestones in the recovery process were made through close cooperation between Progent consultants and the customer:

• Self-hosted web applications were returned to operation without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was brought on-line and accessible to users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were 100% functional.
• A new Palo Alto Networks 850 firewall was brought online.
• Ninety percent of the user workstations were being used by staff.

Conclusion
A likely business disaster was dodged by top-tier professionals, a broad range of knowledge, and tight collaboration. Although in retrospect the crypto-ransomware virus attack detailed here could have been identified and stopped with current cyber security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, staff education, and well designed incident response procedures for data backup and proper patching controls, the reality remains that government-sponsored criminal cyber gangs from Russia, China and elsewhere are relentless and will continue. If you do fall victim to a ransomware incursion, remember that Progent's team of experts has extensive experience in crypto-ransomware virus blocking, cleanup, and data disaster recovery.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this customer story, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting Services in Adelaide
For ransomware recovery expertise in the Adelaide metro area, phone Progent at 800-462-8800 or visit Contact Progent.