Ransomware Defense and Restoration Expertise Barra da Tijuca

Ransomware : Your Crippling IT Nightmare
Ransomware has become a modern cyberplague that poses an existential danger for organizations vulnerable to an attack. Different versions of ransomware like the Reveton, CryptoWall, Locky, SamSam and MongoLock cryptoworms have been out in the wild for many years and continue to inflict damage. More recent strains of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with frequent as yet unnamed viruses, not only encrypt online data files but also infiltrate many accessible system backups. Information replicated to the cloud can also be ransomed. In a vulnerable data protection solution, this can render any restore operations hopeless and basically knocks the network back to square one.

Getting back on-line services and data after a ransomware attack becomes a sprint against the clock as the targeted organization struggles to contain the damage, clear the virus, and restore business-critical operations. Because crypto-ransomware takes time to spread throughout a targeted network, attacks are frequently sprung on weekends and holidays, when penetrations are likely to take longer to notice. This multiplies the difficulty of quickly assembling and orchestrating a knowledgeable response team.

Progent offers an assortment of services for securing Barra da Tijuca organizations from crypto-ransomware events. Among these are team member training to help identify and not fall victim to phishing exploits, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's behavior-based cyberthreat defense to identify and quarantine zero-day modern malware attacks. Progent in addition offers the assistance of experienced ransomware recovery professionals with the talent and commitment to re-deploy a breached network as rapidly as possible.

Progent's Crypto-Ransomware Recovery Support Services
Subsequent to a crypto-ransomware attack, even paying the ransom in cryptocurrency does not ensure that merciless criminals will return the needed keys to decrypt any of your information. Kaspersky Labs estimated that seventeen percent of crypto-ransomware victims never recovered their information after having sent off the ransom, resulting in increased losses. The gamble is also very costly. Ryuk ransoms are often several hundred thousand dollars. For larger organizations, the ransom demand can reach millions. The fallback is to piece back together the key components of your IT environment. Without access to essential data backups, this calls for a wide range of IT skills, top notch team management, and the capability to work continuously until the task is over.

For decades, Progent has made available expert IT services for companies throughout the U.S. and has earned Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts (SMEs) includes engineers who have been awarded top industry certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security experts have garnered internationally-renowned certifications including CISA, CISSP, ISACA CRISC, GIAC, and CMMC 2.0. (Refer to Progent's certifications). Progent also has experience with accounting and ERP applications. This breadth of expertise provides Progent the ability to efficiently identify critical systems and re-organize the surviving pieces of your IT system following a crypto-ransomware attack and assemble them into an operational network.

Progent's recovery group uses state-of-the-art project management applications to coordinate the complex recovery process. Progent understands the urgency of acting swiftly and together with a customer's management and Information Technology team members to prioritize tasks and to get key services back on line as fast as humanly possible.

Case Study: A Successful Ransomware Attack Response
A small business engaged Progent after their organization was crashed by Ryuk crypto-ransomware. Ryuk is generally considered to have been created by North Korean state sponsored cybercriminals, possibly using strategies exposed from America's National Security Agency. Ryuk attacks specific companies with limited ability to sustain operational disruption and is one of the most lucrative versions of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing firm, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in the Chicago metro area and has around 500 staff members. The Ryuk intrusion had frozen all essential operations and manufacturing capabilities. The majority of the client's system backups had been online at the time of the attack and were encrypted. The client considered paying the ransom demand (more than two hundred thousand dollars) and praying for the best, but in the end utilized Progent.

Progent worked together with the client to rapidly understand and assign priority to the key systems that had to be recovered in order to resume business functions:

• Microsoft Active Directory
• Electronic Messaging
• Accounting/MRP

Within 48 hours, Progent was able to re-build Active Directory services to its pre-penetration state. Progent then completed reinstallations and hard drive recovery on needed servers. All Exchange Server schema and attributes were intact, which greatly helped the rebuild of Exchange. Progent was able to collect non-encrypted OST data files (Outlook Offline Data Files) on user desktop computers and laptops in order to recover mail messages. A recent off-line backup of the client's accounting/ERP systems made them able to restore these essential applications back on-line. Although a large amount of work was left to recover completely from the Ryuk event, core systems were returned to operations rapidly:

Throughout the following couple of weeks key milestones in the restoration process were completed through close cooperation between Progent consultants and the client:

• Self-hosted web applications were returned to operation without losing any data.
• The MailStore Microsoft Exchange Server with over 4 million historical messages was spun up and accessible to users.
• CRM/Orders/Invoices/Accounts Payable/Accounts Receivables (AR)/Inventory modules were completely functional.
• A new Palo Alto 850 firewall was brought on-line.
• Ninety percent of the user workstations were functioning as before the incident.

Conclusion
A likely business extinction disaster was dodged with results-oriented professionals, a wide array of IT skills, and tight teamwork. Although in hindsight the ransomware penetration described here would have been identified and blocked with up-to-date security technology and NIST Cybersecurity Framework or ISO/IEC 27001 best practices, user and IT administrator training, and well thought out incident response procedures for data protection and proper patching controls, the reality remains that government-sponsored cyber criminals from China, North Korea and elsewhere are tireless and are not going away. If you do fall victim to a crypto-ransomware penetration, remember that Progent's roster of experts has substantial experience in ransomware virus blocking, mitigation, and file disaster recovery.

Download the Ransomware Removal Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting in Barra da Tijuca
For ransomware system recovery consulting in the Barra da Tijuca metro area, call Progent at 800-462-8800 or see Contact Progent.