Ransomware Prevention and Cleanup Solutions Barra da Tijuca

Ransomware : Your Feared IT Disaster
Ransomware has become an escalating cyber pandemic that presents an existential threat for organizations vulnerable to an assault. Multiple generations of ransomware such as Reveton, CryptoWall, Locky, NotPetya and MongoLock cryptoworms have been running rampant for many years and continue to inflict harm. Newer versions of crypto-ransomware like Ryuk, Maze, Sodinokibi, DopplePaymer, Conti and Egregor, along with more as yet unnamed malware, not only perform encryption of on-line critical data but also infect any configured system backups. Information synched to the cloud can also be encrypted. In a poorly architected environment, this can render any restore operations useless and effectively knocks the network back to zero.

Getting back online services and information after a crypto-ransomware outage becomes a race against time as the victim tries its best to contain, clear the ransomware, and restore enterprise-critical operations. Because ransomware requires time to move laterally across a network, assaults are often launched during weekends and nights, when successful penetrations tend to take more time to uncover. This multiplies the difficulty of quickly marshalling and coordinating an experienced response team.

Progent provides a range of solutions for protecting Barra da Tijuca organizations from ransomware attacks. Among these are team training to help recognize and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response utilizing SentinelOne's AI-based threat defense to detect and disable day-zero malware attacks. Progent also can provide the services of experienced ransomware recovery consultants with the skills and commitment to rebuild a breached system as rapidly as possible.

Progent's Ransomware Recovery Services
Subsequent to a ransomware event, even paying the ransom in cryptocurrency does not guarantee that distant criminals will provide the keys to decipher any or all of your data. Kaspersky estimated that seventeen percent of ransomware victims never recovered their information after having sent off the ransom, resulting in more losses. The risk is also costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom can be in the millions. The other path is to re-install the mission-critical elements of your Information Technology environment. Absent access to complete information backups, this requires a broad complement of IT skills, top notch team management, and the willingness to work non-stop until the job is completed.

For two decades, Progent has provided certified expert Information Technology services for businesses across the US and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts includes professionals who have been awarded top certifications in key technologies including Microsoft, Cisco, VMware, and popular distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISM, CISSP-ISSAP, CRISC, SANS GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has expertise with accounting and ERP application software. This breadth of experience provides Progent the skills to efficiently understand important systems and re-organize the remaining pieces of your network environment following a crypto-ransomware penetration and rebuild them into a functioning system.

Progent's recovery team of experts utilizes powerful project management tools to coordinate the sophisticated recovery process. Progent understands the urgency of acting swiftly and together with a client's management and IT resources to assign priority to tasks and to get key systems back online as fast as humanly possible.

Customer Case Study: A Successful Crypto-Ransomware Penetration Response
A client hired Progent after their organization was penetrated by the Ryuk ransomware. Ryuk is thought to have been created by North Korean government sponsored hackers, possibly adopting technology exposed from the United States NSA organization. Ryuk attacks specific businesses with little tolerance for disruption and is among the most profitable incarnations of crypto-ransomware. Well Known organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturing business headquartered in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had shut down all essential operations and manufacturing capabilities. Most of the client's data backups had been directly accessible at the time of the attack and were damaged. The client was actively seeking loans for paying the ransom (in excess of $200,000) and hoping for good luck, but in the end called Progent.

Progent worked hand in hand the customer to quickly determine and prioritize the essential areas that needed to be recovered in order to continue company functions:

• Microsoft Active Directory
• Microsoft Exchange
• MRP System

Within 48 hours, Progent was able to recover Active Directory services to its pre-virus state. Progent then initiated reinstallations and hard drive recovery on needed systems. All Exchange data and attributes were intact, which facilitated the rebuild of Exchange. Progent was also able to find intact OST data files (Outlook Email Off-Line Folder Files) on staff workstations in order to recover mail messages. A recent off-line backup of the businesses accounting systems made them able to restore these required programs back online for users. Although a lot of work was left to recover totally from the Ryuk virus, core services were restored quickly:

Over the following few weeks critical milestones in the restoration process were accomplished in close collaboration between Progent consultants and the client:

• Internal web sites were brought back up without losing any information.
• The MailStore Microsoft Exchange Server containing more than 4 million historical emails was brought online and accessible to users.
• CRM/Customer Orders/Invoicing/Accounts Payable/Accounts Receivables/Inventory Control capabilities were 100% operational.
• A new Palo Alto Networks 850 firewall was set up.
• Most of the desktops and laptops were fully operational.

Conclusion
A likely business catastrophe was avoided due to results-oriented professionals, a wide array of knowledge, and tight teamwork. Although upon completion of forensics the crypto-ransomware penetration described here would have been prevented with advanced security technology solutions and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user training, and well thought out incident response procedures for information backup and proper patching controls, the fact remains that government-sponsored hackers from China, North Korea and elsewhere are tireless and represent an ongoing threat. If you do fall victim to a crypto-ransomware attack, feel confident that Progent's roster of professionals has extensive experience in ransomware virus blocking, removal, and file recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To read or download a PDF version of this customer story, please click:
Progent's Ryuk Virus Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting in Barra da Tijuca
For ransomware recovery consulting in the Barra da Tijuca metro area, call Progent at 800-462-8800 or go to Contact Progent.