Ransomware Prevention and Recovery Services Allentown

Crypto-Ransomware : Your Crippling Information Technology Catastrophe
Ransomware has become a modern cyberplague that presents an extinction-level danger for organizations unprepared for an assault. Multiple generations of crypto-ransomware like the CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been running rampant for many years and continue to inflict damage. More recent variants of ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, Conti and Egregor, plus frequent unnamed viruses, not only perform encryption of on-line data files but also infect any available system backups. Files replicated to the cloud can also be rendered useless. In a poorly architected data protection solution, it can render automatic restoration hopeless and effectively sets the entire system back to square one.

Recovering applications and information after a crypto-ransomware outage becomes a sprint against the clock as the targeted organization struggles to contain, clear the virus, and resume business-critical activity. Because ransomware needs time to spread across a network, penetrations are usually sprung on weekends and holidays, when attacks tend to take more time to discover. This multiplies the difficulty of quickly assembling and coordinating an experienced mitigation team.

Progent provides a variety of help services for securing Allentown businesses from ransomware penetrations. These include team education to help recognize and avoid phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) utilizing SentinelOne's behavior-based threat defense to discover and suppress zero-day malware assaults. Progent also offers the services of seasoned ransomware recovery consultants with the talent and commitment to reconstruct a compromised network as quickly as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware attack, even paying the ransom demands in cryptocurrency does not guarantee that distant criminals will return the needed codes to decrypt any or all of your information. Kaspersky Labs ascertained that seventeen percent of ransomware victims never recovered their files after having sent off the ransom, resulting in increased losses. The risk is also costly. Ryuk ransoms are often a few hundred thousand dollars. For larger enterprises, the ransom demand can reach millions. The alternative is to re-install the critical components of your IT environment. Absent access to complete information backups, this requires a wide complement of skills, well-coordinated project management, and the willingness to work 24x7 until the job is over.

For two decades, Progent has offered professional Information Technology services for businesses throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have attained high-level industry certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security experts have earned internationally-renowned industry certifications including CISM, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has expertise with financial management and ERP application software. This breadth of experience provides Progent the capability to quickly understand necessary systems and organize the remaining parts of your network environment after a ransomware attack and assemble them into an operational network.

Progent's recovery team of experts uses state-of-the-art project management tools to coordinate the complex recovery process. Progent appreciates the importance of acting rapidly and in concert with a customer's management and Information Technology resources to prioritize tasks and to put the most important systems back on line as soon as possible.

Customer Case Study: A Successful Ransomware Incident Recovery
A small business escalated to Progent after their network was taken over by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state criminal gangs, suspected of adopting algorithms exposed from the United States NSA organization. Ryuk attacks specific companies with limited room for disruption and is one of the most profitable incarnations of ransomware malware. Major victims include Data Resolution, a California-based information warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturer headquartered in the Chicago metro area with about 500 employees. The Ryuk event had paralyzed all business operations and manufacturing capabilities. Most of the client's data protection had been on-line at the beginning of the attack and were encrypted. The client was actively seeking loans for paying the ransom demand (exceeding $200,000) and hoping for the best, but ultimately brought in Progent.

Progent worked with the customer to quickly determine and prioritize the essential services that had to be restored to make it possible to restart business functions:

• Microsoft Active Directory
• Electronic Messaging
• Financials/MRP

In less than 48 hours, Progent was able to rebuild Windows Active Directory to its pre-intrusion state. Progent then completed rebuilding and storage recovery of mission critical systems. All Microsoft Exchange Server ties and configuration information were intact, which accelerated the restore of Exchange. Progent was able to find local OST files (Microsoft Outlook Off-Line Data Files) on various workstations in order to recover mail information. A not too old offline backup of the businesses manufacturing systems made it possible to recover these essential applications back available to users. Although major work remained to recover fully from the Ryuk virus, core services were recovered quickly:

Over the next month important milestones in the restoration project were completed through tight cooperation between Progent team members and the customer:

• Internal web applications were brought back up without losing any data.
• The MailStore Exchange Server exceeding 4 million historical emails was restored to operations and available for users.
• CRM/Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control modules were completely functional.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the desktops and laptops were functioning as before the incident.

Conclusion
A likely enterprise-killing disaster was evaded with results-oriented experts, a wide spectrum of knowledge, and close teamwork. Although upon completion of forensics the ransomware virus attack detailed here would have been identified and disabled with current cyber security technology solutions and security best practices, user and IT administrator training, and properly executed incident response procedures for information protection and proper patching controls, the fact remains that state-sponsored hackers from China, Russia, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a crypto-ransomware incident, feel confident that Progent's roster of experts has extensive experience in ransomware virus defense, cleanup, and information systems recovery.

Download the Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Expertise in Allentown
For ransomware recovery expertise in the Allentown metro area, call Progent at 800-462-8800 or visit Contact Progent.