Ransomware Prevention and Removal Services Bellevue

Crypto-Ransomware : Your Crippling Information Technology Disaster
Ransomware has become a modern cyber pandemic that represents an enterprise-level danger for businesses of all sizes poorly prepared for an assault. Multiple generations of ransomware such as Reveton, Fusob, Bad Rabbit, SamSam and MongoLock cryptoworms have been out in the wild for many years and still cause damage. Newer strains of crypto-ransomware such as Ryuk, Maze, Sodinokibi, Netwalker, LockBit and Egregor, as well as more as yet unnamed malware, not only perform encryption of on-line information but also infect most available system restores and backups. Files synched to off-premises disaster recovery sites can also be ransomed. In a poorly designed system, it can render automated recovery hopeless and basically sets the datacenter back to square one.

Getting back online applications and information following a crypto-ransomware event becomes a race against the clock as the targeted business struggles to stop the spread, cleanup the virus, and resume enterprise-critical activity. Because ransomware requires time to spread throughout a network, attacks are usually sprung during weekends and nights, when successful attacks may take longer to discover. This multiplies the difficulty of promptly mobilizing and coordinating a capable response team.

Progent has an assortment of help services for securing Bellevue organizations from crypto-ransomware events. Among these are user education to help recognize and not fall victim to phishing scams, ProSight Active Security Monitoring for endpoint detection and response (EDR) using SentinelOne's AI-based cyberthreat protection to detect and extinguish zero-day modern malware attacks. Progent also offers the services of veteran ransomware recovery professionals with the talent and commitment to re-deploy a compromised network as rapidly as possible.

Progent's Crypto-Ransomware Restoration Services
Subsequent to a crypto-ransomware attack, paying the ransom in cryptocurrency does not ensure that distant criminals will respond with the codes to unencrypt all your data. Kaspersky determined that 17% of ransomware victims never recovered their data after having sent off the ransom, resulting in additional losses. The gamble is also expensive. Ryuk ransoms are often a few hundred thousand dollars. For larger organizations, the ransom demand can be in the millions of dollars. The other path is to re-install the critical components of your IT environment. Without the availability of full system backups, this requires a broad range of skills, professional team management, and the willingness to work 24x7 until the job is complete.

For twenty years, Progent has offered professional IT services for companies across the US and has achieved Microsoft's Partnership certification in the Datacenter and Cloud Productivity competencies. Progent's group of subject matter experts (SMEs) includes engineers who have attained advanced certifications in foundation technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's security consultants have earned internationally-renowned industry certifications including CISA, CISSP-ISSAP, ISACA CRISC, GIAC, and CMMC 2.0. (Visit Progent's certifications). Progent in addition has experience in financial systems and ERP application software. This breadth of experience affords Progent the capability to knowledgably determine critical systems and integrate the remaining parts of your Information Technology system after a crypto-ransomware penetration and configure them into a functioning network.

Progent's ransomware team of experts uses powerful project management tools to coordinate the complex recovery process. Progent knows the urgency of working quickly and in unison with a customer's management and IT staff to assign priority to tasks and to get key applications back on-line as soon as possible.

Customer Case Study: A Successful Ransomware Incident Recovery
A customer engaged Progent after their network system was taken over by the Ryuk ransomware. Ryuk is thought to have been created by North Korean state cybercriminals, suspected of using algorithms exposed from America's NSA organization. Ryuk targets specific businesses with limited room for disruption and is one of the most profitable instances of ransomware. Major organizations include Data Resolution, a California-based info warehousing and cloud computing company, and the Chicago Tribune. Progent's customer is a single-location manufacturer based in Chicago and has about 500 workers. The Ryuk intrusion had shut down all business operations and manufacturing capabilities. Most of the client's data protection had been directly accessible at the start of the intrusion and were damaged. The client considered paying the ransom (more than $200,000) and praying for good luck, but ultimately brought in Progent.

Progent worked with the client to rapidly determine and prioritize the critical areas that needed to be recovered to make it possible to continue business functions:

• Active Directory (AD)
• Email
• Financials/MRP

In less than 2 days, Progent was able to restore Active Directory services to its pre-intrusion state. Progent then completed rebuilding and storage recovery of critical servers. All Exchange ties and attributes were intact, which facilitated the restore of Exchange. Progent was also able to collect intact OST files (Microsoft Outlook Off-Line Data Files) on staff desktop computers in order to recover mail information. A not too old offline backup of the customer's financials/MRP systems made them able to recover these essential services back servicing users. Although major work needed to be completed to recover fully from the Ryuk event, critical services were returned to operations quickly:

Throughout the following month critical milestones in the restoration project were accomplished in close collaboration between Progent team members and the client:

• Self-hosted web applications were brought back up with no loss of data.
• The MailStore Server containing more than four million historical emails was brought on-line and accessible to users.
• CRM/Product Ordering/Invoices/AP/Accounts Receivables (AR)/Inventory capabilities were fully functional.
• A new Palo Alto Networks 850 firewall was brought on-line.
• 90% of the desktop computers were being used by staff.

Conclusion
A likely business-ending catastrophe was averted by hard-working experts, a wide range of subject matter expertise, and close teamwork. Although in retrospect the crypto-ransomware virus attack detailed here could have been stopped with up-to-date cyber security solutions and ISO/IEC 27001 best practices, staff training, and properly executed security procedures for backup and keeping systems up to date with security patches, the reality is that government-sponsored cybercriminals from China, Russia, North Korea and elsewhere are tireless and are an ongoing threat. If you do get hit by a ransomware incursion, remember that Progent's roster of professionals has proven experience in ransomware virus blocking, remediation, and information systems recovery.

Download the Crypto-Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, please click:
Progent's Ransomware Incident Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware System Recovery Consulting Services in Bellevue
For ransomware cleanup consulting in the Bellevue metro area, phone Progent at 800-462-8800 or see Contact Progent.