Ransomware Protection and Restoration Consulting Bellevue

Ransomware : Your Worst Information Technology Disaster
Ransomware has become an escalating cyberplague that represents an enterprise-level threat for businesses of all sizes poorly prepared for an assault. Different iterations of crypto-ransomware such as CrySIS, WannaCry, Bad Rabbit, SamSam and MongoLock cryptoworms have been replicating for a long time and still cause harm. More recent versions of ransomware like Ryuk, Maze, Sodinokibi, Netwalker, Snatch and Egregor, along with frequent as yet unnamed viruses, not only encrypt on-line critical data but also infect all configured system protection. Data synchronized to cloud environments can also be corrupted. In a vulnerable data protection solution, it can make any recovery useless and effectively knocks the datacenter back to zero.

Recovering applications and information after a ransomware attack becomes a sprint against the clock as the targeted organization tries its best to contain the damage and cleanup the virus and to restore business-critical operations. Because crypto-ransomware requires time to replicate, attacks are often sprung during weekends and nights, when successful attacks tend to take longer to recognize. This multiplies the difficulty of rapidly marshalling and organizing a capable response team.

Progent offers a range of help services for securing Bellevue organizations from ransomware penetrations. Among these are team member education to become familiar with and not fall victim to phishing attempts, ProSight Active Security Monitoring (ASM) for remote monitoring and management, plus deployment of next-generation security gateways with machine learning capabilities to automatically detect and disable day-zero threats. Progent in addition can provide the services of veteran crypto-ransomware recovery professionals with the track record and commitment to restore a compromised environment as quickly as possible.

Progent's Crypto-Ransomware Recovery Help
Subsequent to a ransomware penetration, even paying the ransom demands in cryptocurrency does not guarantee that criminal gangs will return the needed codes to unencrypt any of your information. Kaspersky ascertained that 17% of ransomware victims never restored their files even after having sent off the ransom, resulting in additional losses. The gamble is also very costly. Ryuk ransoms commonly range from 15-40 BTC ($120,000 and $400,000). This is significantly above the typical ransomware demands, which ZDNET estimated to be in the range of $13,000 for small organizations. The alternative is to piece back together the key elements of your Information Technology environment. Without access to full system backups, this calls for a wide range of skill sets, professional project management, and the ability to work continuously until the job is completed.

For twenty years, Progent has offered professional Information Technology services for companies throughout the United States and has achieved Microsoft's Partnership certification status in the Datacenter and Cloud Productivity competencies. Progent's pool of subject matter experts includes engineers who have earned advanced industry certifications in leading technologies like Microsoft, Cisco, VMware, and major distributions of Linux. Progent's cyber security specialists have earned internationally-renowned certifications including CISA, CISSP, ISACA CRISC, and SANS GIAC. (See Progent's certifications). Progent also has expertise in financial management and ERP software solutions. This breadth of expertise provides Progent the capability to quickly identify critical systems and re-organize the surviving components of your Information Technology system following a ransomware event and assemble them into a functioning system.

Progent's ransomware team of experts uses powerful project management systems to orchestrate the complex recovery process. Progent understands the importance of acting rapidly and in unison with a customer’s management and IT staff to prioritize tasks and to get the most important applications back online as soon as humanly possible.

Business Case Study: A Successful Crypto-Ransomware Incident Recovery
A small business sought out Progent after their organization was brought down by the Ryuk ransomware virus. Ryuk is thought to have been created by Northern Korean state sponsored criminal gangs, suspected of adopting algorithms leaked from the U.S. National Security Agency. Ryuk attacks specific businesses with little or no ability to sustain disruption and is among the most lucrative iterations of crypto-ransomware. Well Known targets include Data Resolution, a California-based data warehousing and cloud computing company, and the Chicago Tribune. Progent's client is a single-location manufacturer headquartered in the Chicago metro area with about 500 workers. The Ryuk attack had brought down all essential operations and manufacturing capabilities. Most of the client's system backups had been on-line at the beginning of the attack and were encrypted. The client was actively seeking loans for paying the ransom (exceeding $200K) and wishfully thinking for good luck, but ultimately called Progent.

Progent worked with the customer to rapidly identify and assign priority to the key elements that needed to be restored in order to restart departmental operations:

• Active Directory (AD)
• E-Mail
• Financials/MRP

Within 48 hours, Progent was able to recover Active Directory services to its pre-penetration state. Progent then assisted with reinstallations and hard drive recovery of essential servers. All Exchange Server schema and configuration information were intact, which facilitated the restore of Exchange. Progent was also able to locate intact OST files (Outlook Email Off-Line Data Files) on user desktop computers to recover email data. A not too old off-line backup of the customer’s financials/MRP systems made it possible to return these vital services back online for users. Although significant work was left to recover totally from the Ryuk attack, essential systems were recovered quickly:

During the following few weeks key milestones in the restoration process were completed in close cooperation between Progent team members and the client:

• In-house web applications were returned to operation without losing any information.
• The MailStore Exchange Server with over four million historical emails was spun up and available for users.
• CRM/Product Ordering/Invoicing/Accounts Payable (AP)/Accounts Receivables (AR)/Inventory Control modules were 100 percent functional.
• A new Palo Alto 850 firewall was brought online.
• Nearly all of the user workstations were functioning as before the incident.

Conclusion
A possible business-killing catastrophe was averted through the efforts of top-tier experts, a broad range of IT skills, and close collaboration. Although in hindsight the ransomware attack detailed here would have been disabled with up-to-date security technology and security best practices, user and IT administrator education, and properly executed security procedures for data protection and proper patching controls, the fact is that state-sponsored cybercriminals from China, North Korea and elsewhere are relentless and represent an ongoing threat. If you do get hit by a ransomware incursion, feel confident that Progent's roster of professionals has extensive experience in ransomware virus defense, cleanup, and data recovery.

Download the Ransomware Cleanup Case Study Datasheet
To review or download a PDF version of this case study, click:
Progent's Crypto-Ransomware Recovery Case Study Datasheet. (PDF - 282 KB)

Contact Progent for Ransomware Recovery Consulting Services in Bellevue
For ransomware cleanup consulting services in the Bellevue area, call Progent at 800-462-8800 or visit Contact Progent.