Ransomware Defense and Remediation Solutions Aurora

Crypto-Ransomware : Your Feared Information Technology Disaster
Ransomware has become an escalating cyber pandemic that presents an existential danger for businesses of all sizes poorly prepared for an attack. Different versions of ransomware such as CryptoLocker, Fusob, Bad Rabbit, Syskey and MongoLock cryptoworms have been out in the wild for many years and still inflict havoc. More recent strains of ransomware such as Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Nephilim, along with additional as yet unnamed newcomers, not only perform encryption of online information but also infect any configured system backup. Information synchronized to off-premises disaster recovery sites can also be rendered useless. In a poorly architected system, it can make automated restore operations useless and effectively knocks the network back to zero.

Getting back on-line services and data after a crypto-ransomware outage becomes a race against time as the targeted organization struggles to stop lateral movement, clear the virus, and resume business-critical operations. Since ransomware requires time to move laterally throughout a targeted network, attacks are often launched on weekends and holidays, when attacks tend to take more time to discover. This multiplies the difficulty of promptly mobilizing and organizing a knowledgeable response team.

Progent offers a range of solutions for protecting Aurora organizations from crypto-ransomware penetrations. Among these are team education to become familiar with and avoid phishing exploits, ProSight Active Security Monitoring (ASM) for endpoint detection and response (EDR) utilizing SentinelOne's AI-based threat protection to identify and disable day-zero modern malware attacks. Progent in addition can provide the services of expert ransomware recovery engineers with the skills and perseverance to rebuild a compromised network as rapidly as possible.

Progent's Ransomware Restoration Services
Subsequent to a crypto-ransomware attack, paying the ransom in cryptocurrency does not ensure that distant criminals will provide the codes to decrypt all your files. Kaspersky Labs determined that 17% of ransomware victims never recovered their information even after having paid the ransom, resulting in more losses. The risk is also very costly. Ryuk ransoms are commonly a few hundred thousand dollars. For larger organizations, the ransom can reach millions. The other path is to re-install the critical elements of your Information Technology environment. Absent access to essential data backups, this calls for a wide complement of IT skills, professional team management, and the capability to work 24x7 until the task is complete.

For two decades, Progent has made available professional Information Technology services for businesses across the United States and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes consultants who have earned high-level industry certifications in leading technologies such as Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security specialists have garnered internationally-recognized certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent in addition has experience in accounting and ERP applications. This breadth of expertise provides Progent the skills to efficiently understand important systems and organize the remaining components of your network system following a ransomware attack and configure them into a functioning system.

Progent's security team utilizes best of breed project management applications to coordinate the complex recovery process. Progent knows the urgency of working rapidly and in unison with a client's management and Information Technology staff to prioritize tasks and to put the most important services back online as soon as humanly possible.

Case Study: A Successful Ransomware Virus Recovery
A client hired Progent after their company was penetrated by Ryuk crypto-ransomware. Ryuk is generally considered to have been developed by North Korean government sponsored hackers, suspected of using technology leaked from America's National Security Agency. Ryuk goes after specific companies with little tolerance for operational disruption and is one of the most profitable instances of ransomware. Major victims include Data Resolution, a California-based information warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a small manufacturer based in Chicago and has around 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing processes. The majority of the client's system backups had been on-line at the beginning of the intrusion and were destroyed. The client was actively seeking loans for paying the ransom demand (more than $200,000) and wishfully thinking for the best, but in the end called Progent.

Progent worked together with the customer to quickly identify and prioritize the critical systems that needed to be restored to make it possible to resume business functions:

• Active Directory
• Microsoft Exchange Email
• Financials/MRP

In less than two days, Progent was able to re-build Windows Active Directory to its pre-attack state. Progent then helped perform reinstallations and hard drive recovery of critical servers. All Exchange Server data and configuration information were usable, which facilitated the restore of Exchange. Progent was able to assemble non-encrypted OST data files (Microsoft Outlook Offline Folder Files) on staff PCs in order to recover email messages. A recent off-line backup of the businesses manufacturing software made it possible to recover these essential programs back online for users. Although a large amount of work remained to recover fully from the Ryuk virus, the most important systems were recovered quickly:

During the next few weeks key milestones in the recovery project were completed in close cooperation between Progent team members and the customer:

• Self-hosted web applications were brought back up without losing any information.
• The MailStore Exchange Server exceeding four million historical messages was restored to operations and accessible to users.
• CRM/Orders/Invoicing/AP/Accounts Receivables/Inventory capabilities were 100% restored.
• A new Palo Alto Networks 850 firewall was installed and configured.
• Ninety percent of the desktops and laptops were operational.

Conclusion
A potential business disaster was avoided with top-tier professionals, a wide spectrum of knowledge, and tight collaboration. Although upon completion of forensics the ransomware penetration described here could have been identified and stopped with up-to-date cyber security technology solutions and ISO/IEC 27001 best practices, user and IT administrator education, and well designed incident response procedures for information backup and proper patching controls, the fact is that government-sponsored cybercriminals from Russia, North Korea and elsewhere are tireless and are not going away. If you do get hit by a crypto-ransomware attack, feel confident that Progent's roster of experts has proven experience in ransomware virus blocking, cleanup, and file disaster recovery.

Download the Crypto-Ransomware Recovery Case Study Datasheet
To read or download a PDF version of this ransomware incident report, please click:
Progent's Ransomware Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Restoration Consulting Services in Aurora
For ransomware cleanup consulting services in the Aurora metro area, call Progent at 800-462-8800 or go to Contact Progent.