Ransomware Prevention and Removal Services Albany

Ransomware : Your Worst Information Technology Catastrophe
Ransomware has become a modern cyberplague that presents an extinction-level threat for organizations vulnerable to an attack. Versions of crypto-ransomware like the Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause harm. Modern versions of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, plus frequent as yet unnamed newcomers, not only do encryption of online critical data but also infiltrate any configured system protection mechanisms. Data synched to off-site disaster recovery sites can also be rendered useless. In a poorly architected system, this can make automatic restore operations hopeless and basically sets the entire system back to zero.

Retrieving services and data following a ransomware attack becomes a sprint against time as the targeted organization struggles to contain the damage and eradicate the virus and to resume business-critical operations. Due to the fact that ransomware takes time to move laterally, attacks are frequently sprung at night, when successful attacks are likely to take more time to identify. This multiplies the difficulty of quickly marshalling and orchestrating a capable mitigation team.

Progent makes available an assortment of services for securing Albany organizations from crypto-ransomware penetrations. Among these are staff training to help recognize and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of the latest generation security solutions with AI capabilities to intelligently discover and extinguish zero-day cyber attacks. Progent in addition offers the services of veteran ransomware recovery professionals with the track record and commitment to re-deploy a compromised network as soon as possible.

Progent's Ransomware Recovery Services
Following a ransomware event, paying the ransom in Bitcoin cryptocurrency does not ensure that merciless criminals will respond with the keys to unencrypt all your data. Kaspersky ascertained that 17% of crypto-ransomware victims never recovered their data even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms often range from fifteen to forty BTC ($120,000 and $400,000). This is well above the typical ransomware demands, which ZDNET determined to be approximately $13,000 for small businesses. The other path is to setup from scratch the key parts of your IT environment. Absent access to essential system backups, this calls for a wide complement of skills, well-coordinated project management, and the willingness to work 24x7 until the task is completed.

For two decades, Progent has made available professional IT services for companies throughout the United States and has achieved Microsoft's Gold Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes professionals who have attained advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-recognized industry certifications including CISA, CISSP-ISSAP, CRISC, and SANS GIAC. (See Progent's certifications). Progent in addition has expertise in financial systems and ERP software solutions. This breadth of expertise provides Progent the ability to efficiently identify important systems and organize the remaining parts of your Information Technology environment following a ransomware event and assemble them into a functioning network.

Progent's recovery group utilizes state-of-the-art project management tools to orchestrate the complicated restoration process. Progent understands the importance of acting swiftly and in unison with a customer’s management and Information Technology staff to assign priority to tasks and to get the most important systems back online as fast as humanly possible.

Case Study: A Successful Ransomware Penetration Response
A business escalated to Progent after their network was crashed by the Ryuk ransomware virus. Ryuk is generally considered to have been created by Northern Korean government sponsored cybercriminals, possibly adopting approaches leaked from the United States NSA organization. Ryuk seeks specific organizations with limited tolerance for operational disruption and is one of the most profitable versions of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a regional manufacturing business headquartered in Chicago with about 500 staff members. The Ryuk penetration had shut down all essential operations and manufacturing capabilities. The majority of the client's data protection had been directly accessible at the start of the intrusion and were destroyed. The client was pursuing financing for paying the ransom demand (exceeding $200,000) and wishfully thinking for the best, but ultimately made the decision to use Progent.

Progent worked together with the customer to rapidly understand and prioritize the essential applications that had to be recovered to make it possible to continue departmental operations:

• Active Directory (AD)
• Exchange Server
• MRP System

Within two days, Progent was able to restore Windows Active Directory to its pre-intrusion state. Progent then performed setup and storage recovery of mission critical servers. All Exchange schema and attributes were intact, which accelerated the restore of Exchange. Progent was also able to assemble local OST files (Outlook Email Off-Line Data Files) on user workstations in order to recover mail messages. A recent off-line backup of the client's accounting/MRP software made it possible to recover these vital applications back servicing users. Although a large amount of work was left to recover fully from the Ryuk damage, essential systems were recovered quickly:

During the next month key milestones in the recovery process were achieved in tight collaboration between Progent team members and the client:

• Internal web sites were brought back up with no loss of information.
• The MailStore Exchange Server exceeding four million historical messages was restored to operations and available for users.
• CRM/Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory modules were 100 percent restored.
• A new Palo Alto Networks 850 security appliance was set up.
• Ninety percent of the desktop computers were back into operation.

Conclusion
A possible enterprise-killing catastrophe was averted with dedicated professionals, a broad range of IT skills, and tight collaboration. Although in post mortem the ransomware virus incident described here would have been stopped with up-to-date cyber security systems and NIST Cybersecurity Framework best practices, user and IT administrator education, and properly executed security procedures for information backup and proper patching controls, the fact is that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a crypto-ransomware penetration, remember that Progent's team of experts has substantial experience in crypto-ransomware virus blocking, removal, and file restoration.

Download the Ransomware Remediation Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Services in Albany
For ransomware recovery consulting services in the Albany area, phone Progent at 800-462-8800 or go to Contact Progent.