Ransomware Protection and Restoration Expertise Albany

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Ransomware has become a too-frequent cyber pandemic that presents an existential danger for organizations poorly prepared for an assault. Different iterations of ransomware such as Reveton, WannaCry, Locky, Syskey and MongoLock cryptoworms have been around for years and continue to inflict harm. Newer variants of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, as well as more unnamed newcomers, not only encrypt on-line data but also infect many configured system protection. Files replicated to cloud environments can also be ransomed. In a poorly architected system, this can render automatic restore operations impossible and effectively knocks the datacenter back to zero.

Getting back online applications and data following a ransomware intrusion becomes a sprint against time as the targeted organization struggles to stop the spread, clear the ransomware, and restore enterprise-critical operations. Since ransomware needs time to move laterally throughout a network, assaults are frequently sprung on weekends and holidays, when attacks tend to take more time to recognize. This compounds the difficulty of quickly assembling and orchestrating a knowledgeable mitigation team.

Progent offers a range of services for protecting Albany businesses from crypto-ransomware events. These include team education to help recognize and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based threat protection to discover and extinguish zero-day modern malware assaults. Progent also offers the assistance of veteran ransomware recovery engineers with the skills and perseverance to restore a breached environment as urgently as possible.

Progent's Ransomware Recovery Services
After a ransomware penetration, paying the ransom in cryptocurrency does not provide any assurance that cyber hackers will respond with the needed keys to unencrypt any or all of your files. Kaspersky ascertained that seventeen percent of ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also expensive. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to setup from scratch the mission-critical parts of your IT environment. Absent access to complete information backups, this requires a wide complement of skill sets, top notch team management, and the ability to work non-stop until the recovery project is completed.

For twenty years, Progent has provided professional IT services for companies across the U.S. and has earned Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts includes engineers who have attained advanced industry certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security engineers have earned internationally-renowned industry certifications including CISM, CISSP, CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP application software. This breadth of experience provides Progent the ability to rapidly ascertain necessary systems and re-organize the remaining components of your Information Technology environment following a ransomware attack and assemble them into an operational system.

Progent's recovery group deploys best of breed project management tools to coordinate the complicated recovery process. Progent knows the urgency of working quickly and in concert with a customer's management and Information Technology team members to assign priority to tasks and to get critical applications back online as fast as humanly possible.

Customer Case Study: A Successful Ransomware Intrusion Response
A business engaged Progent after their network system was brought down by Ryuk ransomware virus. Ryuk is generally considered to have been developed by North Korean state sponsored hackers, suspected of using strategies leaked from America's NSA organization. Ryuk attacks specific companies with little tolerance for disruption and is one of the most profitable iterations of ransomware. Major victims include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturing business based in the Chicago metro area with about 500 employees. The Ryuk penetration had disabled all company operations and manufacturing capabilities. The majority of the client's data protection had been on-line at the beginning of the attack and were damaged. The client was actively seeking loans for paying the ransom demand (exceeding two hundred thousand dollars) and praying for the best, but in the end made the decision to use Progent.

Progent worked with the client to rapidly get our arms around and assign priority to the most important areas that had to be addressed in order to restart departmental functions:

• Active Directory (AD)
• Exchange Server
• Accounting and Manufacturing Software

In less than 2 days, Progent was able to recover Active Directory services to its pre-attack state. Progent then helped perform setup and hard drive recovery of critical systems. All Microsoft Exchange Server schema and configuration information were intact, which accelerated the restore of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Folder Files) on staff PCs and laptops in order to recover mail messages. A recent off-line backup of the client's manufacturing software made them able to return these essential applications back on-line. Although a lot of work was left to recover fully from the Ryuk event, the most important systems were returned to operations rapidly:

Over the following month key milestones in the restoration process were achieved in tight cooperation between Progent engineers and the customer:

• Internal web applications were restored with no loss of information.
• The MailStore Microsoft Exchange Server exceeding four million historical messages was brought on-line and available for users.
• CRM/Orders/Invoices/Accounts Payable/AR/Inventory Control modules were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was deployed.
• Ninety percent of the desktops and laptops were back into operation.

Conclusion
A likely enterprise-killing disaster was dodged by dedicated professionals, a wide range of knowledge, and tight teamwork. Although in post mortem the crypto-ransomware attack detailed here would have been blocked with current security solutions and recognized best practices, team education, and well designed security procedures for information backup and proper patching controls, the reality is that state-sponsored cyber criminals from China, Russia, North Korea and elsewhere are relentless and are not going away. If you do get hit by a ransomware penetration, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, mitigation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Consulting in Albany
For ransomware recovery consulting services in the Albany metro area, phone Progent at 800-462-8800 or visit Contact Progent.