Ransomware Filtering and Cleanup Services Adelaide

Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become an escalating cyber pandemic that presents an extinction-level threat for businesses poorly prepared for an assault. Multiple generations of crypto-ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been around for a long time and continue to cause destruction. Newer variants of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, plus additional unnamed newcomers, not only perform encryption of online information but also infiltrate all accessible system backup. Information synched to the cloud can also be corrupted. In a poorly designed data protection solution, this can render automatic restoration useless and basically sets the entire system back to zero.

Retrieving services and information following a crypto-ransomware attack becomes a sprint against the clock as the targeted organization tries its best to stop the spread, eradicate the ransomware, and restore enterprise-critical operations. Due to the fact that crypto-ransomware requires time to move laterally across a network, assaults are usually sprung during weekends and nights, when penetrations in many cases take longer to discover. This multiplies the difficulty of quickly mobilizing and coordinating a knowledgeable mitigation team.

Progent makes available a range of solutions for protecting Adelaide organizations from ransomware events. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's AI-based threat defense to detect and extinguish zero-day malware attacks. Progent also can provide the assistance of experienced crypto-ransomware recovery professionals with the talent and commitment to re-deploy a compromised system as soon as possible.

Progent's Crypto-Ransomware Restoration Support Services
After a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the codes to decrypt any of your data. Kaspersky Labs determined that 17% of ransomware victims never recovered their data even after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom demand can reach millions of dollars. The other path is to setup from scratch the essential elements of your IT environment. Absent the availability of complete system backups, this requires a broad complement of IT skills, well-coordinated team management, and the willingness to work continuously until the recovery project is over.

For decades, Progent has offered expert Information Technology services for companies throughout the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes consultants who have been awarded high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity specialists have earned internationally-recognized certifications including CISM, CISSP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has expertise in accounting and ERP software solutions. This breadth of experience gives Progent the skills to efficiently understand critical systems and re-organize the surviving components of your IT environment after a ransomware penetration and configure them into a functioning system.

Progent's ransomware team of experts deploys state-of-the-art project management tools to coordinate the sophisticated recovery process. Progent understands the urgency of acting swiftly and in unison with a customer's management and Information Technology staff to assign priority to tasks and to get critical applications back on line as soon as possible.

Customer Case Study: A Successful Crypto-Ransomware Virus Recovery
A client sought out Progent after their company was taken over by Ryuk ransomware. Ryuk is believed to have been developed by North Korean state hackers, possibly using strategies leaked from the United States National Security Agency. Ryuk attacks specific businesses with little or no ability to sustain disruption and is among the most profitable iterations of crypto-ransomware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a small manufacturer located in the Chicago metro area and has around 500 staff members. The Ryuk penetration had paralyzed all company operations and manufacturing capabilities. Most of the client's backups had been directly accessible at the beginning of the attack and were eventually encrypted. The client was taking steps for paying the ransom demand (in excess of $200K) and wishfully thinking for good luck, but ultimately brought in Progent.

Progent worked with the customer to rapidly get our arms around and prioritize the critical areas that needed to be recovered to make it possible to resume company functions:

• Active Directory
• E-Mail
• Accounting and Manufacturing Software

Within two days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then assisted with setup and storage recovery on essential applications. All Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was able to assemble non-encrypted OST data files (Outlook Offline Data Files) on user desktop computers and laptops to recover email messages. A recent off-line backup of the client's financials/MRP systems made it possible to recover these essential services back available to users. Although a lot of work was left to recover fully from the Ryuk virus, critical systems were recovered quickly:

Throughout the next few weeks critical milestones in the recovery project were accomplished through tight cooperation between Progent team members and the client:

• Internal web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server with over 4 million archived messages was brought on-line and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory Control modules were completely functional.
• A new Palo Alto 850 firewall was installed and configured.
• 90% of the user PCs were back into operation.

Conclusion
A potential business extinction catastrophe was averted due to dedicated professionals, a wide array of knowledge, and tight collaboration. Although in post mortem the ransomware penetration described here should have been identified and disabled with current security solutions and ISO/IEC 27001 best practices, user and IT administrator education, and properly executed security procedures for backup and proper patching controls, the reality remains that state-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and will continue. If you do fall victim to a ransomware virus, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus defense, removal, and information systems restoration.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Services in Adelaide
For ransomware cleanup consulting services in the Adelaide metro area, phone Progent at 800-462-8800 or visit Contact Progent.