Ransomware Defense and Recovery Solutions Adelaide

Ransomware : Your Crippling IT Catastrophe
Crypto-Ransomware has become a modern cyber pandemic that poses an extinction-level threat for businesses of all sizes vulnerable to an assault. Versions of ransomware like the CryptoLocker, Fusob, Locky, Syskey and MongoLock cryptoworms have been out in the wild for years and continue to inflict harm. Newer variants of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Nephilim, as well as additional unnamed viruses, not only encrypt online files but also infect most configured system protection mechanisms. Files synched to cloud environments can also be rendered useless. In a poorly architected data protection solution, this can make automatic restore operations hopeless and effectively knocks the entire system back to zero.

Retrieving services and information following a ransomware attack becomes a race against the clock as the victim tries its best to contain and clear the ransomware and to resume enterprise-critical activity. Since crypto-ransomware requires time to spread, assaults are frequently launched at night, when successful penetrations in many cases take more time to discover. This multiplies the difficulty of promptly mobilizing and orchestrating a qualified mitigation team.

Progent makes available an assortment of services for securing Adelaide businesses from crypto-ransomware attacks. Among these are user education to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to identify and disable zero-day malware attacks. Progent in addition provides the assistance of seasoned ransomware recovery professionals with the talent and commitment to rebuild a breached system as quickly as possible.

Progent's Ransomware Restoration Help
Subsequent to a ransomware attack, even paying the ransom in cryptocurrency does not provide any assurance that criminal gangs will provide the keys to decipher all your data. Kaspersky Labs determined that seventeen percent of ransomware victims never recovered their data even after having sent off the ransom, resulting in more losses. The gamble is also very costly. Ryuk ransoms often range from 15-40 BTC ($120,000 and $400,000). This is well higher than the average ransomware demands, which ZDNET determined to be approximately $13,000 for small businesses. The other path is to piece back together the critical parts of your IT environment. Without access to full system backups, this calls for a wide complement of IT skills, top notch team management, and the ability to work non-stop until the recovery project is over.

For twenty years, Progent has made available expert Information Technology services for companies throughout the United States and has earned Microsoft's Gold Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes engineers who have attained advanced certifications in foundation technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-recognized certifications including CISM, CISSP, CRISC, and GIAC. (Visit Progent's certifications). Progent also has experience in financial systems and ERP software solutions. This breadth of expertise gives Progent the ability to quickly understand necessary systems and integrate the remaining components of your computer network environment following a ransomware attack and rebuild them into an operational network.

Progent's security team deploys state-of-the-art project management tools to orchestrate the sophisticated recovery process. Progent appreciates the urgency of acting quickly and together with a client's management and Information Technology team members to assign priority to tasks and to get the most important systems back on-line as soon as humanly possible.

Customer Story: A Successful Ransomware Intrusion Restoration
A business engaged Progent after their network was attacked by Ryuk ransomware virus. Ryuk is generally considered to have been deployed by North Korean state criminal gangs, suspected of adopting techniques exposed from the United States National Security Agency. Ryuk attacks specific companies with little or no room for disruption and is among the most profitable iterations of ransomware malware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a small manufacturing company located in Chicago with about 500 workers. The Ryuk attack had shut down all essential operations and manufacturing capabilities. Most of the client's backups had been on-line at the start of the attack and were destroyed. The client was pursuing financing for paying the ransom (in excess of $200,000) and wishfully thinking for good luck, but in the end made the decision to use Progent.

Progent worked with the customer to quickly get our arms around and prioritize the critical systems that needed to be restored in order to restart company functions:

• Microsoft Active Directory
• Microsoft Exchange Server
• MRP System

Within 2 days, Progent was able to rebuild Active Directory services to its pre-virus state. Progent then assisted with rebuilding and storage recovery of mission critical systems. All Exchange Server data and attributes were usable, which facilitated the restore of Exchange. Progent was able to locate local OST files (Outlook Email Offline Data Files) on team desktop computers and laptops to recover mail information. A recent offline backup of the customer's financials/ERP systems made it possible to restore these vital programs back available to users. Although significant work was left to recover completely from the Ryuk attack, the most important systems were restored rapidly:

Throughout the next couple of weeks key milestones in the recovery process were completed in close collaboration between Progent consultants and the customer:

• In-house web sites were restored with no loss of information.
• The MailStore Server containing more than four million archived emails was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control capabilities were 100% restored.
• A new Palo Alto 850 firewall was set up and programmed.
• Ninety percent of the desktop computers were fully operational.

Conclusion
A likely company-ending disaster was avoided by top-tier experts, a broad spectrum of subject matter expertise, and close teamwork. Although in retrospect the crypto-ransomware virus penetration detailed here could have been stopped with current cyber security solutions and ISO/IEC 27001 best practices, team education, and properly executed security procedures for data protection and proper patching controls, the fact is that government-sponsored hackers from Russia, China and elsewhere are relentless and are an ongoing threat. If you do get hit by a crypto-ransomware virus, feel confident that Progent's roster of professionals has a proven track record in ransomware virus blocking, mitigation, and data restoration.

Download the Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting in Adelaide
For ransomware system recovery expertise in the Adelaide area, phone Progent at 800-462-8800 or go to Contact Progent.