Ransomware Defense and Cleanup Services Anaheim

Crypto-Ransomware : Your Worst Information Technology Disaster
Crypto-Ransomware has become a modern cyberplague that poses an enterprise-level threat for businesses of all sizes poorly prepared for an attack. Different versions of ransomware such as CryptoLocker, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause damage. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with more unnamed newcomers, not only encrypt online data but also infiltrate most configured system backups. Information synchronized to the cloud can also be ransomed. In a vulnerable environment, it can make automated recovery impossible and effectively knocks the network back to square one.

Getting back online services and information after a crypto-ransomware event becomes a race against the clock as the targeted organization fights to stop the spread, remove the ransomware, and restore business-critical operations. Because ransomware needs time to spread across a targeted network, attacks are often sprung during nights and weekends, when successful penetrations are likely to take more time to discover. This compounds the difficulty of promptly mobilizing and coordinating a qualified mitigation team.

Progent has a variety of help services for protecting Anaheim enterprises from ransomware events. These include user education to become familiar with and avoid phishing scams, ProSight Active Security Monitoring (ASM) for endpoint detection and response using SentinelOne's behavior-based cyberthreat protection to identify and suppress day-zero modern malware assaults. Progent in addition offers the assistance of experienced crypto-ransomware recovery engineers with the skills and perseverance to rebuild a breached system as rapidly as possible.

Progent's Ransomware Restoration Support Services
Soon after a ransomware event, even paying the ransom demands in cryptocurrency does not ensure that merciless criminals will return the needed keys to unencrypt all your information. Kaspersky estimated that 17% of ransomware victims never restored their information after having paid the ransom, resulting in additional losses. The gamble is also costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions. The other path is to re-install the vital components of your IT environment. Absent access to full system backups, this requires a broad complement of skills, professional project management, and the capability to work non-stop until the task is done.

For twenty years, Progent has provided certified expert IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have earned high-level industry certifications in foundation technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity engineers have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with financial management and ERP application software. This breadth of experience provides Progent the ability to quickly determine important systems and integrate the remaining components of your Information Technology environment following a ransomware penetration and configure them into an operational system.

Progent's security team of experts deploys top notch project management applications to orchestrate the complicated restoration process. Progent knows the urgency of working quickly and together with a client's management and Information Technology team members to assign priority to tasks and to get critical services back on line as fast as possible.

Customer Story: A Successful Ransomware Penetration Restoration
A small business engaged Progent after their network system was taken over by Ryuk ransomware. Ryuk is believed to have been deployed by North Korean state criminal gangs, possibly adopting techniques exposed from the United States National Security Agency. Ryuk goes after specific companies with little ability to sustain disruption and is one of the most profitable iterations of ransomware viruses. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing business, and the Chicago Tribune. Progent's client is a small manufacturing company headquartered in Chicago and has about 500 workers. The Ryuk event had disabled all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the start of the attack and were damaged. The client was taking steps for paying the ransom (more than two hundred thousand dollars) and praying for the best, but ultimately engaged Progent.

Progent worked with the client to rapidly determine and assign priority to the key systems that had to be recovered to make it possible to resume business functions:

• Microsoft Active Directory
• Electronic Messaging
• MRP System

Within 2 days, Progent was able to re-build Windows Active Directory to its pre-virus state. Progent then accomplished rebuilding and hard drive recovery on needed applications. All Exchange data and attributes were intact, which facilitated the restore of Exchange. Progent was also able to assemble non-encrypted OST data files (Outlook Email Offline Folder Files) on various PCs in order to recover email information. A recent offline backup of the businesses accounting/MRP software made them able to recover these vital programs back servicing users. Although major work was left to recover totally from the Ryuk virus, the most important systems were restored quickly:

During the following month critical milestones in the restoration project were made through tight collaboration between Progent consultants and the client:

• In-house web sites were restored without losing any data.
• The MailStore Server with over four million historical emails was restored to operations and available for users.
• CRM/Product Ordering/Invoices/AP/AR/Inventory Control modules were 100 percent operational.
• A new Palo Alto Networks 850 security appliance was installed.
• Nearly all of the user PCs were operational.

Conclusion
A possible business catastrophe was dodged due to dedicated professionals, a wide spectrum of IT skills, and close teamwork. Although in hindsight the ransomware incident detailed here would have been prevented with advanced security technology solutions and NIST Cybersecurity Framework best practices, staff education, and appropriate security procedures for information backup and applying software patches, the reality remains that state-sponsored hackers from China, North Korea and elsewhere are tireless and will continue. If you do get hit by a ransomware incursion, remember that Progent's team of professionals has a proven track record in crypto-ransomware virus defense, cleanup, and data recovery.

Download the Crypto-Ransomware Remediation Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Cleanup Expertise in Anaheim
For ransomware cleanup consulting services in the Anaheim area, call Progent at 800-462-8800 or go to Contact Progent.