Ransomware Filtering and Recovery Consulting Arlington

Crypto-Ransomware : Your Feared Information Technology Catastrophe
Crypto-Ransomware has become a too-frequent cyber pandemic that presents an extinction-level danger for businesses poorly prepared for an attack. Multiple generations of ransomware such as Reveton, Fusob, Locky, Syskey and MongoLock cryptoworms have been around for a long time and still cause havoc. Modern versions of ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, LockBit and Nephilim, along with frequent as yet unnamed newcomers, not only encrypt online information but also infiltrate many configured system restores and backups. Data synchronized to cloud environments can also be rendered useless. In a poorly designed data protection solution, it can make any restore operations useless and effectively knocks the network back to square one.

Getting back on-line services and information following a ransomware outage becomes a race against the clock as the targeted organization fights to contain, eradicate the virus, and restore business-critical operations. Due to the fact that ransomware requires time to spread throughout a targeted network, assaults are usually launched during weekends and nights, when successful attacks in many cases take more time to recognize. This compounds the difficulty of promptly marshalling and orchestrating a knowledgeable mitigation team.

Progent has a range of services for securing Arlington businesses from ransomware events. These include team member training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response utilizing SentinelOne's AI-based cyberthreat protection to identify and suppress day-zero modern malware attacks. Progent in addition can provide the assistance of veteran crypto-ransomware recovery engineers with the skills and commitment to rebuild a breached environment as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a ransomware penetration, paying the ransom in cryptocurrency does not ensure that merciless criminals will respond with the needed keys to decrypt any or all of your information. Kaspersky Labs estimated that 17% of crypto-ransomware victims never restored their information after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly several hundred thousand dollars. For larger organizations, the ransom can reach millions of dollars. The fallback is to re-install the mission-critical components of your Information Technology environment. Without access to full data backups, this calls for a broad complement of IT skills, well-coordinated project management, and the willingness to work continuously until the task is completed.

For decades, Progent has offered certified expert IT services for companies across the US and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes consultants who have attained advanced certifications in leading technologies like Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's cyber security specialists have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (See Progent's certifications). Progent in addition has experience with accounting and ERP applications. This breadth of expertise affords Progent the skills to rapidly determine critical systems and integrate the surviving parts of your computer network environment after a ransomware event and assemble them into an operational network.

Progent's security team utilizes top notch project management tools to coordinate the complicated recovery process. Progent knows the urgency of working swiftly and in unison with a customer's management and IT team members to prioritize tasks and to put critical systems back on line as soon as humanly possible.

Customer Story: A Successful Crypto-Ransomware Attack Restoration
A client hired Progent after their network system was attacked by Ryuk ransomware. Ryuk is thought to have been deployed by North Korean government sponsored criminal gangs, suspected of adopting techniques exposed from the United States National Security Agency. Ryuk seeks specific businesses with little or no room for disruption and is one of the most profitable incarnations of ransomware viruses. Well Known victims include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's client is a single-location manufacturing business based in the Chicago metro area and has about 500 workers. The Ryuk penetration had shut down all company operations and manufacturing processes. Most of the client's data backups had been online at the beginning of the attack and were damaged. The client was evaluating paying the ransom (more than $200K) and praying for the best, but ultimately reached out to Progent.

Progent worked together with the customer to rapidly identify and assign priority to the essential services that had to be restored in order to restart departmental functions:

• Microsoft Active Directory
• Electronic Messaging
• MRP System

Within two days, Progent was able to recover Windows Active Directory to its pre-penetration state. Progent then assisted with setup and hard drive recovery of needed servers. All Microsoft Exchange Server data and configuration information were intact, which greatly helped the rebuild of Exchange. Progent was also able to locate non-encrypted OST files (Outlook Email Offline Folder Files) on user desktop computers and laptops to recover email messages. A not too old offline backup of the client's accounting/MRP systems made them able to return these essential programs back available to users. Although major work remained to recover fully from the Ryuk virus, core systems were returned to operations rapidly:

Over the following month key milestones in the recovery project were made in close collaboration between Progent team members and the client:

• Internal web sites were restored without losing any information.
• The MailStore Microsoft Exchange Server exceeding four million archived messages was brought online and available for users.
• CRM/Customer Orders/Invoices/Accounts Payable (AP)/AR/Inventory Control capabilities were fully functional.
• A new Palo Alto 850 firewall was installed.
• Nearly all of the user PCs were back into operation.

Conclusion
A potential business extinction catastrophe was avoided by top-tier professionals, a wide spectrum of technical expertise, and close collaboration. Although in post mortem the ransomware incident detailed here would have been stopped with modern security solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user education, and appropriate security procedures for data backup and applying software patches, the reality remains that government-sponsored cyber criminals from Russia, North Korea and elsewhere are relentless and will continue. If you do get hit by a crypto-ransomware incursion, feel confident that Progent's roster of professionals has substantial experience in crypto-ransomware virus blocking, mitigation, and information systems recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this case study, click:
Progent's Ryuk Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Services in Arlington
For ransomware cleanup services in the Arlington metro area, phone Progent at 800-462-8800 or go to Contact Progent.