Ransomware Protection and Removal Solutions Albany

Ransomware : Your Crippling Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyberplague that poses an existential danger for businesses of all sizes poorly prepared for an assault. Versions of ransomware such as Dharma, WannaCry, Locky, NotPetya and MongoLock cryptoworms have been replicating for many years and still cause harm. Modern strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Nephilim, as well as daily unnamed newcomers, not only encrypt online data but also infiltrate all accessible system protection. Information synched to off-premises disaster recovery sites can also be ransomed. In a poorly designed system, this can make any recovery impossible and basically sets the datacenter back to zero.

Getting back programs and data after a crypto-ransomware attack becomes a race against time as the targeted business tries its best to stop lateral movement, cleanup the ransomware, and restore enterprise-critical operations. Since ransomware takes time to spread throughout a targeted network, attacks are often sprung at night, when penetrations typically take longer to identify. This multiplies the difficulty of promptly mobilizing and organizing a qualified mitigation team.

Progent makes available a variety of support services for protecting Albany businesses from ransomware attacks. These include team training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to detect and suppress zero-day malware attacks. Progent in addition provides the services of expert crypto-ransomware recovery consultants with the talent and commitment to re-deploy a compromised network as quickly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Following a crypto-ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will provide the keys to decipher any of your information. Kaspersky Labs estimated that 17% of ransomware victims never restored their data even after having sent off the ransom, resulting in more losses. The risk is also expensive. Ryuk ransoms are typically several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The alternative is to re-install the mission-critical parts of your Information Technology environment. Absent access to complete data backups, this requires a wide complement of skill sets, well-coordinated team management, and the ability to work non-stop until the job is finished.

For decades, Progent has offered professional Information Technology services for companies throughout the U.S. and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's team of subject matter experts (SMEs) includes consultants who have attained advanced industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have garnered internationally-recognized certifications including CISA, CISSP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has expertise with accounting and ERP software solutions. This breadth of expertise affords Progent the capability to knowledgably determine critical systems and re-organize the remaining components of your IT environment after a ransomware attack and assemble them into a functioning system.

Progent's recovery team of experts has powerful project management tools to coordinate the sophisticated recovery process. Progent knows the importance of working swiftly and in concert with a client's management and Information Technology team members to prioritize tasks and to get the most important systems back online as soon as possible.

Customer Case Study: A Successful Crypto-Ransomware Virus Recovery
A small business hired Progent after their organization was crashed by Ryuk crypto-ransomware. Ryuk is thought to have been developed by North Korean government sponsored hackers, suspected of adopting strategies exposed from the United States National Security Agency. Ryuk attacks specific companies with little or no ability to sustain disruption and is one of the most lucrative incarnations of ransomware malware. High publicized victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's customer is a single-location manufacturing company headquartered in the Chicago metro area and has around 500 workers. The Ryuk penetration had frozen all essential operations and manufacturing processes. Most of the client's backups had been online at the time of the intrusion and were encrypted. The client considered paying the ransom demand (in excess of $200K) and praying for good luck, but ultimately utilized Progent.

Progent worked with the client to rapidly identify and prioritize the essential areas that needed to be recovered in order to resume company functions:

• Active Directory (AD)
• Exchange Server
• Financials/MRP

In less than two days, Progent was able to restore Active Directory to its pre-attack state. Progent then initiated reinstallations and storage recovery on the most important servers. All Exchange Server ties and configuration information were usable, which accelerated the restore of Exchange. Progent was also able to collect non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on staff workstations and laptops in order to recover email information. A recent off-line backup of the businesses financials/ERP software made them able to recover these essential applications back online. Although a large amount of work still had to be done to recover completely from the Ryuk damage, essential services were restored quickly:

Over the next month critical milestones in the restoration process were completed through close collaboration between Progent engineers and the client:

• In-house web applications were returned to operation with no loss of data.
• The MailStore Exchange Server exceeding 4 million historical emails was restored to operations and available for users.
• CRM/Customer Orders/Invoicing/Accounts Payable (AP)/Accounts Receivables/Inventory capabilities were fully functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A possible business-killing disaster was dodged due to hard-working experts, a wide range of knowledge, and tight collaboration. Although upon completion of forensics the crypto-ransomware virus penetration described here could have been disabled with modern security technology and recognized best practices, team education, and well thought out incident response procedures for data backup and keeping systems up to date with security patches, the fact remains that government-sponsored cyber criminals from Russia, China and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, feel confident that Progent's roster of experts has extensive experience in ransomware virus blocking, removal, and data restoration.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Albany
For ransomware cleanup consulting in the Albany metro area, call Progent at 800-462-8800 or visit Contact Progent.