Ransomware Defense and Recovery Expertise Anaheim

Ransomware : Your Feared IT Nightmare
Crypto-Ransomware has become an escalating cyberplague that presents an extinction-level danger for businesses vulnerable to an assault. Versions of ransomware like the CrySIS, CryptoWall, Locky, Syskey and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Snatch and Nephilim, as well as daily unnamed viruses, not only encrypt online files but also infiltrate all accessible system backups. Information synched to cloud environments can also be rendered useless. In a poorly architected system, this can make automatic recovery useless and basically knocks the datacenter back to square one.

Getting back programs and data after a ransomware outage becomes a race against time as the targeted business tries its best to contain, clear the crypto-ransomware, and restore mission-critical activity. Because ransomware takes time to spread throughout a network, penetrations are usually launched on weekends and holidays, when penetrations in many cases take longer to identify. This multiplies the difficulty of rapidly marshalling and organizing a capable response team.

Progent makes available an assortment of solutions for securing Anaheim organizations from ransomware attacks. These include team member training to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring for endpoint detection and response using SentinelOne's behavior-based threat protection to detect and disable day-zero malware assaults. Progent in addition offers the assistance of expert ransomware recovery engineers with the talent and commitment to restore a compromised environment as soon as possible.

Progent's Ransomware Restoration Help
Following a ransomware attack, paying the ransom in cryptocurrency does not provide any assurance that distant criminals will respond with the needed keys to decrypt any of your files. Kaspersky Labs determined that 17% of crypto-ransomware victims never restored their information even after having sent off the ransom, resulting in additional losses. The risk is also costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger enterprises, the ransom can be in the millions. The fallback is to setup from scratch the mission-critical components of your IT environment. Without the availability of complete information backups, this requires a broad complement of skills, professional project management, and the willingness to work 24x7 until the recovery project is done.

For two decades, Progent has offered expert IT services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have attained top certifications in important technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cybersecurity consultants have garnered internationally-renowned industry certifications including CISM, CISSP-ISSAP, ISACA CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent also has experience with accounting and ERP application software. This breadth of experience affords Progent the ability to knowledgably ascertain critical systems and organize the surviving parts of your Information Technology environment following a ransomware event and rebuild them into an operational system.

Progent's ransomware group uses powerful project management systems to coordinate the complicated restoration process. Progent knows the importance of acting swiftly and in unison with a customer's management and Information Technology team members to prioritize tasks and to get the most important services back on line as fast as possible.

Case Study: A Successful Crypto-Ransomware Incident Restoration
A client escalated to Progent after their network was attacked by Ryuk crypto-ransomware. Ryuk is believed to have been launched by North Korean state criminal gangs, possibly adopting approaches exposed from America's NSA organization. Ryuk goes after specific companies with little tolerance for operational disruption and is one of the most profitable instances of ransomware. Well Known victims include Data Resolution, a California-based data warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a regional manufacturing company headquartered in Chicago and has around 500 staff members. The Ryuk penetration had disabled all business operations and manufacturing capabilities. The majority of the client's data backups had been on-line at the beginning of the intrusion and were damaged. The client was evaluating paying the ransom (more than $200K) and praying for the best, but in the end brought in Progent.

Progent worked together with the customer to quickly get our arms around and prioritize the essential applications that had to be restored to make it possible to continue company functions:

• Active Directory
• Exchange Server
• MRP System

Within 2 days, Progent was able to restore Windows Active Directory to its pre-virus state. Progent then helped perform setup and hard drive recovery of essential servers. All Microsoft Exchange Server schema and attributes were intact, which greatly helped the restore of Exchange. Progent was able to collect intact OST files (Outlook Email Offline Folder Files) on user PCs to recover mail data. A recent offline backup of the businesses accounting/ERP software made them able to return these required services back servicing users. Although significant work was left to recover fully from the Ryuk damage, essential services were recovered quickly:

During the following month key milestones in the restoration process were achieved through close collaboration between Progent team members and the customer:

• In-house web sites were returned to operation without losing any information.
• The MailStore Server exceeding 4 million archived emails was brought on-line and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables/Inventory capabilities were 100 percent recovered.
• A new Palo Alto Networks 850 firewall was set up and programmed.
• Nearly all of the user PCs were being used by staff.

Conclusion
A potential business-ending disaster was dodged by dedicated professionals, a broad range of IT skills, and close teamwork. Although in hindsight the crypto-ransomware penetration described here would have been prevented with up-to-date security solutions and ISO/IEC 27001 best practices, staff education, and appropriate incident response procedures for data protection and applying software patches, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do get hit by a ransomware penetration, remember that Progent's roster of professionals has extensive experience in crypto-ransomware virus defense, remediation, and file recovery.

Download the Crypto-Ransomware Removal Case Study Datasheet
To review or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Anaheim
For ransomware cleanup services in the Anaheim metro area, phone Progent at 800-462-8800 or go to Contact Progent.